Secfense Chief Technology Officer, Marcin Szary, joins host Cameron D’Ambrosi to explore the current authentication landscape. They discuss why FIDO Alliance has been a truly transformative moment for the death of the password, how Secfense sets itself apart in a crowded and competitive landscape, and Marcin’s predictions for the future.
Cameron D'Ambrosi, Senior Principal at Liminal
Marcin Szary, Chief Technology Officer
Cameron D’Ambrosi [00:00:16] Welcome everyone to the State of Identity. I’m your host, Cameron D’Ambrosi. Joining me this week is Marcin Szary, Chief Technology Officer at Secfense. Marcin, thank you so much for joining us. And I apologize in advance for butchering the pronunciation of your name now.
Marcin Szary [00:00:30] Hello, everyone. Cameron, thanks for having me on the show. Thank you. Don’t worry about the mispronunciation. I don’t mind.
Cameron D’Ambrosi [00:00:38] Fantastic. Well, thank you for humoring me and for making time this afternoon. I have been excited about this conversation. You know, identity. There’s an intersectionality of digital identity. And cybersecurity remains one of the most dynamic areas of the digital identity market landscape. And certainly in 2023, even as we’ve seen that capital markets cool off a little bit, one area, in particular, continues to draw intense investor interest, and that is cybersecurity, you know, specifically platforms that can help wrap around this notion of, you know, access identity across the full breadth of their perimeter. So this is a relevant conversation. And the markets have shown us that even as things are retrenching a little bit, the demand for better solutions in this authentication space, in the cybersecurity space, our demand is so, so high—so a relevant conversation and so excited to have you.
Marcin Szary [00:01:48] Yeah, I’m glad to have the conversation too.
Cameron D’Ambrosi [00:01:51] So in short, from a 15,000-foot level, for someone who is not familiar with the Secfense platform, what’s your elevator pitch? How do you explain what you do in a brief way?
Marcin Szary [00:02:02] Well, we help large organizations like non-pure tech companies from the regulated space like banking insurance, government agencies with the very heterogeneous I.T. environment. We help them create a unified, strong authentication layer onto their entire infrastructure, which is a pain it meets. It will save them a lot of money and manpower. And so that’s what we do with our tech.
Cameron D’Ambrosi [00:02:34] So, you know, I think this is an area that is of intense interest to both me personally and professionally, as well as I think the broader digital identity community right now, which is, you know, where are we in terms of getting rid of passwords? It’s been this almost ongoing joke, like the death of the password, the death of the password, the death of the password. It’s still alive. We’ve pumped many, many bullets into its body and it’s still getting up and walking across the room and trying to bite us in the face. You know, if you had to put a progress point, a measure of like, how far have we come and maybe how far do we have left to go when it comes to getting all organizations globally away from relying on a single authentication factor that is a shared secret. What would you say the current state is and how do you feel about our progress so far?
Marcin Szary [00:03:32] The death of passwords was prophesied so many times that it’s like a joke when anyone brings it up in the conversation that, okay, this time it will happen. And I do remember it like 20 years ago that Bill Gates said the password almost 20 years ago. Bill Gates said the passwords are dead. But yeah, obviously, we still leave and read them all day long. I mean, all the time. But, iPhone, this time it actually may work. In the end, it’s because things where this time we’re done differently. And then I’m talking about the Fido alliance and the open specification and why. I mean, the difference in the approach may help us get rid of the passwords completely. Hopefully, I’ll I’m right and I won’t be just five years from now. Another guy was claiming that, okay, this time it will work. But I mean yeah it may work for many reasons and so may maybe I’ll just of course, Fido was and was discussed with your prominent guests before me and but I think we can just bring what is Fido, right. This is like the transformative force or maybe like a few words. What is Fido? So this is this. Eventually, all the big tech and non-stick guys have decided to create this open standard for strong authentication. And so with the help of Google, Apple, Microsoft, and Visa, MasterCard, and all the other Big B guys, they’ve contributed to the specification, to the technology readiness, etc. So at the end of the day, we have this ready for the masses. Cryptography, like real strong authentication for the masses. That’s the sum it up and it’s hopefully it will stay with us for long and we’ll eradicate passwords eventually.
Cameron D’Ambrosi [00:05:36] And, when you said, this time we think we’ve got it right and that this might actually be what successfully transitions us away from the password. You alluded to the FIDO layer and open standards and getting all the big tech players on board. Do you think from a consumer perspective that consumers are in a different place when it comes to adopting these technologies? Or has it always been about ubiquity and getting a coherent mass of companies, putting passwordless options in front of consumers in order to get kind of this wave to break? Where do you think the critical piece that’s going to drive widespread adoption is stemming from?
Marcin Szary [00:06:22] You know, the critical thing has already happened. And I mean, I don’t want to sound but using a password but passkey seemed to be there. The step that was needed for the mass consumer adoption and learning more about passkey. So FIDO standards was it was built around this crypto-based identity that you would create online, but they usually required either physical key, a dedicated physical key that may be problematic when you lose it or you have at least two, etc.. But you also could have used your local like biometrics in your phone to create virtual identities online. But again, if your phone has died, you’d have a problem. Bus guys have introduced this like an intermediary layer. You could create secure identities on your phone, then they migrate to your computer, etc.. So it completely removes the friction. And this the problem that most consumers may have in mind with when thinking about transitioning to passwordless. So that’s super important and anyone in the industry is talking about, Perskie said there is a reason for that. And so yeah, there are other things before that, but Passkey should, in my opinion, is like the strongest accent and in that path.
Cameron D’Ambrosi [00:07:53] And, that’s a great point around this evolution of authentication in some ways. Right. A password. The fundamental challenge with a password is not well, there’s many problems with passwords, but the fundamental one is it’s not really bound very well to you as an individual. Right. It’s this notion of a shared secret that theoretically only you know. The problem is it ends up getting stored a bunch of places, which means you’re very clearly not the only one who knows it. When you move to a passkey, we can bring in factors. You know something you have, right? You’re going to get that Fido two passkey maybe stored in the secure enclave of your hardware device, which means you can prove possession of a very specific thing. And then you can layer on, you know, biometrics on that device as well. So now you’re bringing in something you are factor, which is really getting us closer to that end state of actually authenticating the user and not authenticating this piece of abstract knowledge that is the password. How are you at SEC fence thinking about this binding of the credential to the individual, you know, across the lifecycle when you’re both creating the identity as well as when you’re doing account recovery? Because I think in many ways that’s the most interesting part of past keys to me is the fact that you kind of have to fundamentally rethink this entire user journey to be, you know, to make sure you’re giving this authenticator to the right person and then can give it back to the right person when they maybe need to come in and reset it after they drop their phone in the toilet or something like that.
Marcin Szary [00:09:31] Yeah, yeah, sure. Shared Secrets was always a problem, but actually, there wasn’t even it wasn’t the problem only for passwords. If you think about the OTP-based MFA, it also. Is built around shared secrets. You wouldn’t think about it in the same way as you would think with passwords. Passwords are hashed, but in most cases, the ODB seeds are stored, in most cases in plaintext. So that MFA build that it was supposed to be helping you. But in fact, it doesn’t solve the truth problem of this secret. And as you as you as you mentioned, the secret is shared with the application with the application owners that the that you create accounts in and malicious reverse proxies may intercept them, etc.. So many, many ways you can lose that shared secret in your browser by malicious browser extension, etc.. Sharing a secret was never a good idea in the seventies, but it’s not a good idea right now. So on the contrary, fight of two based, the credentials are based on this public cryptography. So there’s never a secret being revealed to the third party. And that changes everything Fido Fido do beyond security is also is also very privacy aware of technology. So all the identities that you create are in complete isolation. And so if you again, if you bring passwords back. We suffered all suffered from this pain that before maybe before password. Yes, we had some password that we liked. And then with the proliferation of applications, people tend to create a variant of the passwords across multiple applications. And we also we also had email accounts with those passwords down to specific applications you could create and you can manage those identities and you could have you could like bind it back again to a single persona with Fido, two credentials, it was the Fido two specification. It was designed in a way that identities cannot can never be bound to a physical person. So even to give you an example, the Uber keys or security keys in general, they are not allowed to have serial numbers. So the your browser or whatever party talking to your key is never in a position of revealing the true number of your key. Of course, it may. It may reveal batch number. So you can create this attestation rules. You can filter out the keys that you want to have in a system. But we will never create a situation where you can actually point to a specific that that generated the identities. So I think that that’s super important. Among the. So you bring the you bring that the. Hmm. You mentioned that the identities sometimes there are situations where the digital identity should be about a physical persona to a physical real person. And there is a market for that. We have all the we have all these KYC vendors. They can make that chain of trust whenever possible. But in many cases, you don’t have to know from the perspective of the application owner. You don’t really have to know the real person behind the account that is that the person is having in your application. So this privacy layer is, I think is super important. That’s the you know, the standard was built with this in mind. That was one of the three pillars security, privacy, inconvenience, three pillars that vital to us was built on. And it’s unprecedented. So even if you lose a key, if you lose the phone, no one will actually be able to recreate your identities without the, like, unlocking authenticating. I mean, no identities are not stored on the device. Period.
Cameron D’Ambrosi [00:14:04] So from a buyer perspective, this is a really interesting time as well because there’s a lot of different options, a lot of choices for deploying Fido to right to your earlier point. The beauty of Fido two is that it is based on open standards, fully, you know, interoperable, right, using Web often. How is the tech fence really differentiating itself from competing MFA platforms? And how are you, you know, reaching out to buyers? What do you think your edge is in winning business in a crowded authentication landscape?
Cameron D’Ambrosi [00:19:18] When I speak with buyers about Passwordless, I think the most interesting thing to me is more than any technology I’ve certainly ever talked about in the enterprise setting. There is true unanimity of opinion, almost to a man or woman. Everybody says I 100%. I need passwordless technology. I’m definitely going to deploy it. But then when you ask them, well, so you’re deploying it right now, they say, well, you know, maybe or, you know, maybe it’s going to be in the next 1 to 3 years. What do you think those biggest barriers like, what are the humps that buyers are still needing to get over when it comes to finally taking this leap? You know, is it just budget? Is it just time? Is it because we’re heading into a potential economic downturn and folks are battening down the hatches? Like what? What is going to get us over the line? We’ve talked a lot about this death of the password, how maybe we’re going to finally get it done. What do you think is going to be the straw that breaks the proverbial password camel’s back here?
Marcin Szary [00:20:17] Hmm. That’s a good observation. I might be biased. I look at those customers’ problems from the perspective of cell phones. And I try to get the broader view. So given mine that we have all the building blocks in place. That’s right. If you want to build an application right now, there should be no excuse for not bringing passwordless. Every mobile device is supporting it natively. Windows hello can support it can become this bridge to Fido. No extra. So everything is in play. Your browser supports that. So from the consumer perspective, everything is in place. If you build the application, you can use webOS then to enrich your application with Passwordless authentication ceremony. But so this should be fine if you build your application from scratch and you’re responsible for a single application, let’s say, like all the tech giants, they should already have passwordless. In my opinion, they should. There should be no reason for not having passwordless. But for some reason, they still use like YouTube. If only so we can add an extra layer of authentication. But they don’t go fully passwordless yet. Maybe it’s still too early. For some reason, they did some risk analysis. I don’t know. But if you look at the Enterprise and again I said I might be a little biased, there is this complexity I’ve mentioned. And so you can have an identity provider from either Microsoft or Okta or other big players, and they can become your source of truth for identities. And if you have obligations that can be easily federated via SAML, IDC, whatever federation standard you would use, there should be no friction for that for the deployments, and especially if you consume a lot of SaaS applications. Most of these SaaS-facing enterprises, they should have these federation standards built-in. So you can create this single sign or strategy when your single source of truth is the only place that you should be upgrading to a passwordless. But it turns out that’s the ideal world. Like is the illusion of we don’t live in the ideal world. Organizations are not built like lots of musicians are not like this. And so even if you have partially migrated to the passwordless world, you would have these hundreds of apps still difficult to upgrade. For those reasons I brought up previously and many others, I guess. But it’s really I think it should be the passwordless transition should be happening right now. I mean, I think a lot of teams in enterprise and non-enterprise customers are already doing this. And we are just in this transitioning space. And so I think if we had this conversation maybe two, three months from now, maybe it would be discussing it differently. Maybe more and more Passwordless first applications would be more present, and especially after Fido2 is present and available for customers. And give you an example, there’s recently, there was a huge news that all this division of ANZ Bank has implemented U2F as a way of authentication. So, they’ve advertised that as Fido-based authentication. So people initially thought that that’s going to be like a passwordless authentication based on Fido. But then it turns out that it’s a U2F like an extra layer for communication. So not fully PASSWORDLESS. And the problem is that people have realized that it’s not a solution for banking systems. They still cannot authorize the transaction because they would not know the context. Right. So you can authenticate, but then it doesn’t really make sense. You want to authorize a transaction of sending like X amount of dollars to another account. U2F right now does not give you a context. Even if you use phones. There are some hacks you can actually hack the UI to give that to bring the context. But it’s not built-in yet. And I think that might be a critical thing. So if it was already available like this authentication path, if it was available on any phones, then banks would have this incentive to transition to Fido. And because they would save a lot of money for sending like four SMS passwords, they send one thing, passwords to authorize transactions. There are millions of dollars being in SMS codes being sent every month. So that could be the force that could change habits at the global scale. And then people, first of all, they might think, okay, if the bank is using it, if I can use it to not only authenticate to the banking system, but then I can authorize the transaction. You know, I got used to the ceremony. Maybe that’s the way I could authenticate and then authorize critical transactions in any obligation, etc. So maybe I’m just guessing.
Cameron D’Ambrosi [00:26:13] I love it. Hey, you know, these are the kind of insights that our listeners want to hear. One is prognostications from those close to the source, if you will. So, you know, let’s keep our prognostication hat on. I’m fond of asking folks to make predictions for the future of the space in general. We’ve talked a little bit about a lot of forward-looking things, but more broadly speaking, what are you excited to see over the course of the next year in the digital identity space, in the authentication space? Any other predictions that you would like to share with our audience soon?
Marcin Szary [00:26:55] I don’t know for sure, but I have a gut feeling that I would do some stuff without integration, and then you could. So again, I might miss a bit in the authentication space. It will likely disrupt any other spaces, and the issue should not be the exception. Right now, we can see the price of fishing, like perfectly pitched fishing email campaigns with the greater conversion rate compared to those written by people. So that’s one thing. And maybe that’s another force that would push us towards real MFA unfeasible solutions. And I mean, when I’m talking about phishing, I mean phishing aimed at stealing credentials. Not the ones that are supposed to convince you to install some malware. But the most popular kind of phishing is the one that would try to steal your credentials either by leading, by guiding you to some malicious page or to guide you through the even more dangerous through malicious reverse proxy. So all non-fatal MFA solutions will be defeated. And so this is probably something that is already affecting the authentication world in a good way. Right now we see more victims due to the phishing campaigns. But again, it might drive this adoption of real MFA authentication. Beyond that. Hmm. Yeah. I hope Fido2 will stay for good with us. It’s not like a wave that will fade. But this is something that will transform the way we authenticate. And wearables would play more significant roles. I don’t know. I’m not a prophet. So I’m really excited about the future, though. But I don’t know what else I could add to that.
Cameron D’Ambrosi [00:29:46] I think that’s fantastic, and I think you’re completely spot on with regard to I think we’ve opened Pandora’s box, so to speak, and we’re not really sure what’s going to leap out. So exciting developments there. And we’ll see what happens. To bring it to a close, for folks who are listening, who want to learn more about Secfense, want to reach out to you and the team to deploy Secfense or learn more about it, what is the best place for them to go?
Marcin Szary [00:30:19] You can visit us on Secfense.com, that’s fence with an ‘S’ at the end, and we will happily provide a demo. We can do a poc deployment. They are suited for enterprise customers. They don’t engage too much. It’s like a go super easy process, and that’s the best way. If you go to Secfense.com, there is a contact form, you can reach out to us from there.
Cameron D’Ambrosi [00:30:48] Amazing. Well, Marcin, thank you so much for your time. Greatly, greatly appreciated. Fantastic insights. And again, this is one of the most exciting areas of the digital identity landscape right now. So always great to have a true expert to share their thoughts with us.
Marcin Szary [00:31:05] Thank you, Cameron. This was a pleasure. Thank you very much.
Cameron D’Ambrosi [00:31:08] All right. Speak with you soon.
In the latest State of Identity podcast, hosted by Cameron D’Ambrosi, we’re joined by Laura Spiekerman, co-founder and president of Alloy, a global identity risk solution for financial services and a Liminal 2023 Company to Watch. We’ll discuss its pioneering role in the orchestration-centric approach to Digital Identity in Fintech. Spiekerman delves into the challenges Alloy addresses in the fintech space, where compliance and fraud often hinder innovation. Join us to explore the evolving landscape of digital identity in Fintech, trends in fraud prevention, and the critical intersection of customer experience and security.
In the latest episode of the State of Identity podcast series, we delve into the ever-evolving world of customer identity and access management (CIAM). Join host Cameron D’Ambrosi from Liminal as he sits down with Brian Pontarelli, the founder and CEO of FusionAuth, to explore the exciting developments and challenges in the realm of passwordless authentication, user data management, and the quest for seamless transitions in the digital landscape. Bryan shares his expertise and unique perspective, shedding light on the fascinating journey of FusionAuth and its pivotal role in this dynamic landscape. Tune in for a thought-provoking discussion that promises to expand your understanding of CIAM and its critical role in the modern enterprise.
Tune in to the latest episode of the State of Identity podcast series, where Data Security expert Shane Curran, Founder and CEO of Evervault, dives deep with host Cameron D’Ambrosi into the intricacies of data security. Discover why basic encryption methods aren’t enough, understand innovative data security strategies that ensure functionality, learn how encryption safeguards AI model training without compromising customer data, and grasp the significance of prioritizing current cybersecurity threats over quantum computing concerns.
In the latest episode of the State of Identity podcast, host Cameron D’Ambrosi is joined by Gadalia Montoya Weinberg O’Bryan, an ex-NSA crypto mathematician and the Founder and CEO of Dapple Security. Learn about Gadalia’s remarkable journey from the National Security Agency to the forefront of identity-focused cybersecurity. Learn about the limitations of current passwordless approaches, particularly in scenarios involving lost or stolen devices, and delve into the crucial distinction between authenticating the user behind the device rather than the device itself. Gadalia introduces Dapple Security’s unique solution, which involves generating an on-demand passkey using a user’s fingerprint—emphasizing the company’s commitment to user privacy by avoiding the storage of biometrics on the device or in the cloud—and how this approach is a key element in enhancing overall security posture.
In this episode of the State of Identity podcast, host Cameron D’Ambrosi talks with Eric Olden, the co-founder and CEO of Strata Identity. Join us as they discuss the challenges faced by today’s multi-vendor/multi-cloud enterprise technology landscape and how forward-looking executives view identity as an opportunity, not a cost center. They also delve into the importance of moving towards passwordless authentication and the role of identity orchestration in addressing these challenges.
In this episode of the State of Identity podcast, Liminal host Cameron D’Ambrosi and Justin McCarthy, the co-founder and CTO of StrongDM explore the dynamic landscape of digital identity and access management, addressing the challenges and trends that shape the industry. They talk about what it means to move towards a “credential-less” world and discuss the complexities of authentication, authorization, and the role of proxies in bridging old and new technologies. McCarthy highlights the imperative for convergence among various tools, including the essential role of AI, providing a unified approach to access control, governance, and policy enforcement.