>> Hey welcome back everybody, Jeff Frick here with The Cube.
We're in downtown San Francisco
at LinkedIn's headquarters at Data Privacy Day 2018.
Second year we've been at the event,
pretty interesting, you know there's a lot
of stuff going on in privacy.
It kind of follows the security track,
gets less attention but with the impending
changes in regulation it's getting
much more play, much more media.
So we're excited to be joined by our next guest.
He's Jerrod Chong the Vice President of product at Yubico.
Jerrod, welcome.
>> Thank you Jeff.
So for folks that aren't familiar with Yubico,
what are you guys all about?
>> We're all about protecting people's
identities and privacies and making them
the authenticate securely to online accounts.
>> So identity, that's so, an increasingly
important strategy for security.
Don't worry about the wall, can we really
figure out who this person is.
So how has that been changing over the last couple years?
>> Yes there's definitely a lot of things been changing.
So we can think of identity as some
some companies want to know who you are.
But some companies actually are okay
with you being anonymous but then they want to still know
that is the person that they talk to
is still the person.
And so what we see in the wall of data is--
>> An anonymous person as opposed to a not--
>> Someone else.
We want to make sure the anonymous person
is the same anonymous person.
>> Oh okay, okay, right.
>> And that's important, right?
If you can think of like a journalist
and you think of they need to talk to the informer
so they need to know that this is the real informer.
And they don't want to have the fake informer
tell them the wrong story.
And so they need a way to actually
strongly authenticate themselves.
And so identity is a very interesting
intersection of strong authentication.
But at the same time, real identities
as well as anonymous identities.
And there are actually real life applications for both
that can protect citizens, can protect dissidents
but also at the same time can help governments
do the right things when they know who you are.
>> Right, so we're so far behind that I still
can't understand why you dial
into the customer service person
and you put in your account number
and they still want to know you're mom's maiden name.
And we've told them all a thousand times
that can't be much of a secret anymore.
And then I read something else that said
the ability to use a nine digit social security number
and keep that actually private is basically,
the chances of doing that are basically zero.
So we're well past that stage
in terms of some of these more sophisticated systems
but we still kind of have regulations
that are still asking you to put in
your social security number.
So what are the ways that you guys
are kind of addressing that?
And you're kind of taking a novel approach
with an open source solution which is pretty cool.
>> Yes we've created the open standard
which is FIDO U2F standard
and we actually co-created this with Google.
And one of the key things is that
what we call knowledge-base systems
are just a thing of the past.
Knowledge-base is anything that you try to remember
including passwords.
And what we call recovery questions.
You know, you name the recovery question
that you want to put in.
>> Right right, your dog, your pet, you know your street.
>> And you can get everything online
from LinkedIn or Facebook.
So why are we doing those systems?
And obviously they are, we need to change that.
But this open standard that we've created
really allows you to physically prove yourself
with a physical device.
Like, so you want to tell who you are
and there are a couple ways you can tell
who you are online.
You can tell by remembering something,
by something that you have,
and something that who you are, right?
So these are the basics in how you can
identify yourself over the wire.
And what we've really focused on is the combination
of something you have and something you know.
But the something you know is not revealed to the world.
The something you know is revealed
to the device that you have.
So it's kind of like your ATM card.
You're not going to tell the PIN to the world.
Nobody really has you ATM,
nobody asks you for the ATM.
Even the banks don't know what your ATM is
and you can change that and only you know about it.
And it's only on the card.
And so we take that same concept
and make it available for companies to implement
these types of authentication systems
for their own services.
So today Google supports this open standard.
Actually today Facebook supports it as well.
And SalesForce and hosts of other services.
Which means that you can actually authenticate yourself
with a device and something you know.
And that really allows you as an individual
to not have to think about all these
different things that you have to remember
for every single site because that's what people
are doing today.
And so the beauty about this protocol as well
is that, is what the developer's think,
Is that these systems, they don't know
that you have the same authenticator.
Which is a great thing, so they can't collude and share
and then pinpoint it was you.
If you took this authenticator you can use it
with many different things but all of them
don't know that you have what we call the YubiKey.
And so this is, the YubiKey that we--
>> So it's like the old RSA key, what we think
a lot of people are familiar with.
>> What people think, obviously we've,
it's way beyond RSA key.
>> Right, but it's the same kind of concept,
you've got a USB a little device--
>> And that's what you bring with you and that's who you are.
And you can strongly authenticate
to the servers that you want.
And I think that's really the foundation
which is people want to take back
the way that they authenticate through the systems
and they want to own it.
And that's really a big difference that we see
rather than the banks that you must have this
or you must have that and you can only use it with me
you can't use it with somebody else.
I want to bring my authenticator anywhere.
>> So you said Google's using that.
I'm a huge Google user, I don't have one of those things.
So where's the application?
Is that something that I choose
because I want to add another layer of protection
or is that something that Google says hey Jeff,
you're such and such a level of customer user et cetera
we think you should take this to the next level.
How does that happen?
>> So it's actually been available since the end of 2014.
It's part of the step up authentication.
The latest iteration of the work that Google has done
is the Google advanced protection program.
Which means that you can enable one of these devices
as part of your account.
And one of the things they've done
is that for those users at risk
you can only log in with these devices.
Which really restricts--
>> So they define you as a high risk person
because of whatever reason.
>> And they encourage you, hey please protect yourself
with additional security measures.
And the old additional security measures
used to be like, you know, send me an SMS text.
But that's actually pretty broken right now.
We've seen it being breached everywhere
because of what we call phone hijacking.
You know, I pretend to be you and I've got your phone number
and you know, now I've got your phone.
>> Shoot I thought that was a good one.
>> That is known, there's lot video how you can do that.
And so this is available now for everyone.
Everyone has a gmail account,
you can go into your account it says
I want step up authentication.
They call it two step verification.
And then they walk you through the process.
And then you get one of these in the mail?
>> You actually have to buy these
but Google has been providing within different communities,
they've been seeding the market,
we've been also doing a lot of advocacy work.
Many different types, even here today
we've distributed a lot of YubiKeys
for all of the journalists to use.
But in general users will go online
to Amazon or something and you would
buy one of these devices.
>> So then and then once I have that key
and I bought into that system
is you're saying then I can use that key
for not just Google but my Amazon account--
>> Anyone that supports--
>> Anyone that supports that standard?
>> Exactly, anybody that supports the standard.
And that standard is growing extremely rapidly
and it's users, it's big companies using it,
developers of sites are using it.
So the thing that we created for the world back in 2014
is now being actually accelerated
because of all these breaches.
They are very relevant to data breaches,
identity breaches, and people want to take control.
>> Right, I'm just curious,
I'm sure you have a point of view,
you know why haven't the phone companies
implemented more use of the biometric data piece
that they have whether, now they're talking about
the face recognition or your finger recognition
and tied that back to the apps on my phone?
I still am befuddled by the lack of that integration.
>> There's definitely, there are definitely
solutions in that area.
And I think, but one of the challenges
that just like a computer, just like a phone,
it's a complicated piece of software.
There's a lot of dependencies.
All it takes is one software to get it wrong
and the entire phone can be compromised.
So you're back into complicated systems, complex systems,
people write these systems, people write these apps.
It takes one bad developer to mess it up for everybody else.
So it's actually pretty hard
unless you control every single ecosystem that you build
which is vastly difficult now in the mobile space.
The mobile carriers are not just,
it's not just from AT&T, you've got the OS,
you've got you know, Google, the Android phone.
You've got AT&T, you've got the apps on the phone,
you've got all the, you know, the various processes,
the components that talk to different apps
and you've got the calling app,
you've got all of these other games.
So because it's such a complicated device
getting it right from a security perspective
is actually pretty difficult.
So, but there are definitely applications
that have been working over the years
that have been trying to leverage the built in capabilities.
We actually see it as the YubiKey
can actually be used with this device.
And then you can use these devices after you bootstrap them.
What we deemed as, what we call blasted device.
So you can use multiple different things.
And the standard doesn't always define
that you just use the hardware device of the YubiKey.
You can use a phone if you trust the phone.
We want to give flexibility to the ecosystem.
>> So I'm just curious in terms of the open standard's
approach for this problem, how that's gaining traction.
Because clearly, you know,
open source is done very very well,
you know far beyond Linux as an operating system.
But you know so many apps and stuff
run open source software, components of open source.
So in terms of market penetration
and kind of adoption of this technology
versus the one single vendor key that you used to have,
how is the uptake, how is the industry responding?
Is this something that a lot of people are getting behind?
>> It's definitely getting a lot of traction in the industry.
So we started the journey with Google
and what was happening was that
in order to work with this prominent scale
you have to believe that just between, you know,
Yubico and Google can't solve this problem.
And if the answer is you got to do my thing,
no one's going to play in this game.
Just a high level.
So I think what we've done is that the open standard
is the catalyst for other big players to participate.
Without any one vendor going to necessarily win.
So today if, there's a big plenary going on
at FIDO and it's really iteration
of what we've developed with Google.
And now we're taking the next level with actually Microsoft.
And we've called it FIDO 2.
So from U2F, FIDO Universal Second Factor, to FIDO 2.
And that entire work that we've done with Google
is now being evolved into the Microsoft ecosystem.
So, and we'll see in a couple months,
you will start to see real Microsoft products
being able to support the same standard.
Which is really excellent because what do you use every day?
You either use, there's three major platform players
that you have today, right you have,
you either use a Google type of device, Chrome or Android.
You use a Microsoft device, you've got Windows everywhere.
Or you use an Apple device.
So, and the only way these large internet companies
are going to collaborate is if it's open.
If it's closed, if it's my stuff,
Google's not going to implement it
because it's Microsoft stuff,
Microsoft's not going to implement Apple stuff.
So the only way you can--
>> I dunno about the Apple part
of that analogy but that's okay.
>> That's true, that's true, but I think
it's important that the security industry
working with the identity issue, work together.
And we need to move away from all this
one up, proprietary things.
Because it makes it really difficult for the users
and the people to implement things.
And if everybody's collaborating
like an open standard, then you actually
can make a dent in the problem that you see today.
>> And to your point, right, with BYOD,
which is now, used to be a thing,
it's not a thing obviously everybody's
bringing their own devices.
To have an open standard so people
at different types of companies
with different types of ecosystems
with different types of users
using different types of devices
have a standard by which they can build these things.
>> Absolutely.
>> Exciting times.
>> Alright Jerrod, well thanks for
taking a few minutes out of your day.
We look forward to watching the Yubico story unfold.
>> Exactly, thank you very much.
>> Alright, very good.
He's Jerrod, I'm Jeff, you're watching The Cube
where Data Privacy Day 2018, thanks for watching.