Driven by a mission and passion to fight online crime, Ori Eisen, Founder and CEO of Trusona, explains the fundamentals of passwordless authentication and why it is a superior and simpler way of securing access. He also dispels several myths and addresses potential adoption hurdles, ranging from incompatibility with legacy applications to transition costs, regulatory compliance, privacy concerns, and more. Ori offers some valuable tips and recommendations to protect individuals from becoming victims of hacking. Finally, he shares some hilarious jokes at the end.

Time Stamps

02:40 -- If you could give us a little bit of a primer on what is passwordless authentication.

05:10 -- So can you help dispel some of the myths around passwordless authentication?

09:10 -- What would be some factors that could influence an organizational decision of adopting a particular method?

11:32 -- So how are users being authenticated? And what about that information that is being used to authenticate individuals? How is that secure? And if that falls in the hands of the wrong, folks, isn't that concerning?

14:44 -- So when I was doing my research on this topic, and I was trying to learn about the pros and cons of passwordless authentication, something that came up was incompatibility with legacy applications. Could you speak to that?

16:12 -- Okay, now, you mentioned FIDO. What is FIDO?

17:32 -- So it seems like we don't have to choose between convenience or security, we can have the best of both worlds, right?

19:07 -- Now the solution sounds great. And we need to move in that direction. What about the cost aspect of it? I've read that the cost implications can be significant. Is there any truth to that?

21:04 -- What about the regulation aspect of it, I was reading somewhere that -- regulations require clear information on data storage, considering the sensitive nature of passwordless data when it isn't stored appropriately, there could be a lot of issues, would you? How would you react to this statement?

23:46 -- What about privacy concerns? You think users, you know, how would you alleviate privacy concerns amongst users?

25:29 -- What is the relationship between passwordless authentication, multi-factor authentication, and mobile multi-factor authentication?

28:17 -- Multi-factor authentication becomes much stronger and effective if you were to go passwordless. Correct?

29:09 -- Well, let's talk about the bad guys. And let's talk about your motivation, what got you doing, what you're doing, and all the great things you've been doing and trying to reduce or fight online crime.

30:59 -- What tips or recommendations would you have to anyone from protecting themselves from different types of attacks?

34:15 -- So, Ori, what are your thoughts about a strong password and how best to store passwords?

37:24 -- Ori, share with us that VC joke that I heard in one of your other podcasts the other day. I think our listeners would love to hear that joke.

39:27 -- What's the other joke?

40:13 -- Any final words to wrap up this session?

Memorable Ori Eisen Quotes/Statements

"Maybe passwords are not the most secure thing. And our parents are not security experts we should trust with creating long and complicated ends, passwords. So the whole idea of getting passwordless is to remove this factor, which as you probably know, contributes to 81% of all the data we see lost out there and just do away with it. Because the technology to do it is already in our pockets."

"The first thing to know is that passwordless authentication does not use static passwords that users pick. So that's the first thing to know. So obviously, you can ask, Well, what does it use? It uses the very same architecture and technology we already have used for e-commerce in the form of HTTPS certificates, and public and private keys."

"Putting your passwords into a password vault does not eliminate them. And if you were to inspect with Wireshark or Ethereal, the connectivity between you and the server, you'll see that the password vault only saves you from remembering it, but it's still on the wire. So if you have malware or anything like a Man-In-The-Middle, you are still revealing your credentials."

"It's not about money anymore. The delta between going passwordless or not, on many of the systems is just your sheer will. That's it."

"So I'm a proponent of not changing the taboo, not changing the security behavior, because then you have something to overcome. Let's make it easy, ubiquitous, and democratize it."

"I hope today if I say fax me your resume, you'll think that's crazy. I hope that using a password will be just as crazy a few years from now."

Trusona Links

Link to free WordPress plugin: https://wordpress.org/plugins/trusona/

Try a passwordless login: https://www.trusona.com/workforce/try

Ball To All: https://www.balltoall.org/; Or on social media @balltoall

Thorn: https://www.thorn.org/

----------------------------------------------------

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Welcome to the Cybersecurity Readiness Podcast

series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

A Holistic and High-Performance

Approach, a recently published book by SAGE publishing. He has

been studying cybersecurity for over a decade, authored and

edited scholarly papers, delivered talks, conducted

webinars and workshops, consulted with companies and

served on a cybersecurity SWAT team with chief information

security officers. Dr. Chatterjee is an Associate

Professor of Management Information Systems at the Terry

College of Business, the University of Georgia and

Visiting Professor at Duke University's Pratt School of

Engineering.

Hello, everyone. I'm delighted to

welcome you to another episode of the Cybersecurity Readiness

Podcast. Today, we will be talking about the myths and

realities of passwordless authentication. I'm really

excited to welcome our guest on today's show, Mr. Ori Eisen,

truly, a highly distinguished player, member of the

information technology community. He has spent the last

two decades fighting online crime, and holds over two dozen

cybersecurity patterns. He is the founder and CEO of Trusona,

that offers the world's first insured authentication solution.

Prior to founding Trusona, Ori was the founder at 41st

parameter, the leading online fraud prevention and and

detection solution for financial institutions that was acquired

by Experian in 2013. And, prior to that, Mr. Eisen served as the

Worldwide Fraud Director for American Express. And prior to

that, Ori was the Director of Fraud Prevention for VeriSign

Network Solutions. By developing new and innovative technologies,

he skillfully reduced fraud losses by over 85% in just three

months. So, it's truly a pleasure to have Ori on the show

today. Welcome Ori!

Thank you for having me, Dave, and hello to all the

listeners.

So Ori, when I was reading about your

contributions about a passwordless world that we might

be entering in the near future, I'm excited; and I have a whole

bunch of questions. And I'm sure our listeners have similar

questions as well. So let's get started. And if you could give

us a little bit of a primer on what is passwordless

authentication.

In the 60s, when computing really took off, many

people wanted to use a computer. And they got into the point of

doing time sharing. So if you had 10 people trying to use the

same mainframe, you got the hours one to two, and your

friend got two to three. And in order to reserve your time slot

they used a password; was easy and quick, everybody know how to

do it. When the 90s come about, we are still using passwords.

And again, maybe system admins and other people used it, but no

one ever thought it would be embedded in every single factor

of our life. And factor is used with a pun. I think today when

you look at what happened to Facebook just a few hours ago

and 1.5 billion users username and password leaked online. It

really shows you how penetrable the world of cyber security is

if we're only leaving passwords to be the gateway between you

and your money, you and your identity you and your medical

records and so forth. So in 2015, I joined both Ted Schlein

from Kleiner Perkins and Frank Abagnale. on a journey to say,

Hey, can we start a journey which I know everybody said

can't be done. And it's difficult and it's, you know,

hard to change the world. But we started this journey to say, why

not what else needs to happen, Dave, for us to say, you know

what, maybe passwords are not the most secure thing. And our

parents are not security experts we should trust with creating

long and complicated ends, passwords. So the whole idea of

getting passwordless is to remove this factor, which as you

probably know, contributes to 81% of all the data we see lost

out there and just do away with it. Because the technology to do

it is already in our pockets. It's just that we have not made

an effort as a, you know, community to make that step.

I couldn't agree with you more, it is such

a great need, we need to move in that direction. Absolutely. In

fact, I'm sure our listeners would like to know that

according to the Verizon Data Breach Report, in 2019 alone,

81% of hacking related breaches involved the use of lost or

stolen credentials. And yet, we are still egulfed in the world

of passwords. Gartner predicts that by 2022, 60% of large and

global enterprises, and 90% of midsize enterprises will

implement passwordless methods in more than 50% of use cases,

that's a very good sign. So Ori, what are some, you know, it's

too good to be true, right? Like even now, I hate to admit this,

but I have to keep track of 50 or 60 different passwords.

They're not totally different, but they are different. And I am

kind of ashamed that I am I am still doing that. And I haven't

come up with something more sophisticated. But I wonder you

know, when there's a saying that when something is too good to be

true, it probably is. So can you help dispel some of the myths

around passwordless authentication?

Dave, remembering 40 or 50 is good news. You're lucky

if you're a system admin at a large company you have 200

passwords you need to know. And many have to write them down,

put them in an Excel sheet, or even get into a password vault.

So the first thing I'll dispel is, why do I need to go

passwordless if I'm using a password vault? Well, for two

reasons. Putting your passwords into a password vault does not

eliminate them. And if you were to inspect with Wireshark or

Ethereal (network protocol analyzer), the connectivity

between you and the server, you'll see that the password

vault only saves you from remembering it, but it's still

on the wire. So if you have malware or anything like a

Man-In-The-Middle, you are still revealing your credentials. That

is the main reason that I'm a big proponent of this. Yes,

there's a UX (User Experience) aspect that it's easy to use.

Yes, it will be saving money because less people will call

your Help Desk to say I forgot my password, right. But from a

security perspective, it's so easy just to get malware on a

computer, wait for the good guy to get in. And that's it, you

got their credentials, that is really what we need to change.

So the first thing to dispel is that, you know, password vaults

do not change that, right, they kind of put the passwords under

the carpet, so to speak, so you don't see them. But let me tell

you, they're still there, and they're still transmitted on the

wire. The second thing I would dispel is, many companies in the

space who were not ready, they were kind of caught flat footed

by not having passwordless; devised very clever means and

tricks to convince their customers that they have gone

passwordless, even though they didn't; let me give you a

classic example. Say that you log in from the same IP address

every day, I can then tell my authentication system that if

Dave comes in from the same IP to just let you sail through

without needing to type username and password, so they call that

quote unquote, passwordless. That is really called risk based

authentication for those of you who are listening, and it still

doesn't solve the core issue that if somebody gets a hold of

your username and password, even if they come from a different IP

address, yes, they will be challenged with it. And with

those static credentials they can get in. So I just wanted you

to see that just doing the little bit, the small move, is

not really going to save our society from this scrooge of

static passwords.

Thank you for that. Thank you for that.

That's very enlightening. So let's say if an organization

wants to move in the direction of passwordless authentication,

there are many methods of doing so. Right. And so how would you

know what would be some factors that could influence an

organizational decision of adopting a particular method?

And if I'm wrong, please correct me. You are the expert here.

Yeah, let me tell you after doing this now for five

years, what I would recommend everybody who's listening,

whether they have their own website or blog on a personal

level, or they're working for a company. Early on in our

journey, we offered it and still do a free plugin for WordPress.

WordPress is one of the most prolific website editors, go

implement Trusona for your WordPress site, even if it's

your personal site and play with it, experience it, try to beat

it, try to hack it, try to see, what would it take to break it.

And after you have that epiphany, ask yourself as a

consumer and ask yourself as a security practitioner, well, why

aren't we doing this everywhere? The reason we have given this

for free, other than to learn user behavior and perfect

software, is to give people something to start with.

Otherwise, I agree with you, Dave, it feels like a bridge too

far. Like, it's too good to be true. No, the year is now the

time is here. Go try something because it's free. So you can't

say I can't get the money to do it. It's not about money

anymore. The delta between going passwordless or not, on many of

the systems is just your sheer will. That's it. Now, I would

assure you that in many cases, when we offer it to consumers,

it's free. So that's not a reason for an organization not

to take it. But yes, you need to use the Trusona app, so but

people who don't want to see our brand, and want to buy our stuff

as a white label, sure, you need to pay at some point. But the

point is, it's so easy to get started now with integrations to

most systems, most, you know, SAS (Software-As-A-Service)

ervices that you cannot fin any excuse of it's too diffi

ult or too expensive or too hard We have taken that off the t

ble. Now it's all about the shee will of people to stop using

passwords, and curb the funding f evil. And we can talk about th

t as we go through

Yes, in fact, I want to also inform the

listeners that you are one of those people who's who's very

big on fighting online crime. He's dedicated his life to

fighting online crime. He volunteers with Thorn, the

digital defenders of children. He founded Ball to All, a

charity that donates free soccer balls around the world to

children who have never had one. He's a founding member of

Security Canyon, Arizona's cybersecurity coalition. So Ori

is truly a wonderful human being. And it's such a pleasure

to have him on the show today. So, Ori, following up on what

you were talking about, and pardon me if I'm repeating

myself here, but a little bit of redundancy never hurts. So when

we say passwordless authentication. So how are users

being authenticated? And what about that information that is

being used to authenticate individuals? How is that secure?

And if that falls in the hands of the wrong, folks, isn't that

concerning?

Great questions. So let's take two steps back. And

again, help demystify what is passwordless authentication. The

first thing to know is that it does not use static passwords

that users pick. So that's the first thing to know. So

obviously, you can ask, Well, what does it use? It used the

very same architecture and technology we already have used

for e commerce in the form of HTTPS (Hyper Text Transfer

Protocol Secure) certificates, and public and private keys

(encryption methods). So if you buy into the notion that it's

better to send my credit card online, when it is encrypted,

and I have the private key, and the other side have their own

private key, and we have a common public key, and you agree

mathematically that this is safe. What if I told you that

the credentials we use are just like a credit card that is then

encrypted on one end, and decrypted on the other end, so a

man in the middle cannot just open them up, cannot reuse them?

And furthermore, we've added a layer called anti replay knowing

that some of the malware will listen to our traffic, and will

simply try to replay it not knowing what the values are, but

they'll say, look, if it opened the door on Monday, it should

open the door on Tuesday. Alas, the answer is no. When you look

undercover into what we're doing, we've built mechanism

that if you send exactly the same transmission, again, we

would block it as saying this is not real. And this is not our

true persona or Trusona. So I can go into more details of how

the mechanics work. But for simplification, if you know how

PKI (Public Key Infrastructure) works, this is exactly it. We're

using the crypto store on your mobile phone to store a private

key that never leaves your phone. Hence it is distributed.

So Dave, if we put our identity on a million different phones,

and you are a hacker, you now need to crack a million phones

to get to them as opposed to one database filled with passwords.

So it's the same kind of technology, but now democratized

through the fact that most people have a smartphone and

have some kind of a biometric to unlock it.

Okay, okay. Good to know, good to know. So

when I was doing my research on this topic, and I was trying to

learn about the pros and cons of passwordless authentication,

something that came up was incompatibility with legacy

applications. Could you speak to that?

Absolutely. When we look into the future, and we see

protocols like FIDO (Fast Identity Online), we will

absolutely use it when you can. But the world is filled with

computers and systems that lived in the past and never knew this

new standard is coming. So we started way before FIDO existed

or became a standard, with some proprietary technology that

allows us to scan a QR code on an ATM, then move the session to

your mobile phone, extract the identity as we discussed before,

and send it to the backend to be authenticated. And if you're a

little bit more technical, or you know the IAM space, what

happens is that the backend sends a SAML (Security Assertion

Markup Language) assertion to the system to say, Yep, this is

Dave, please open his door. So with everything that does not

use the latest technology, we kind of downgrade the interface

to use either push notification or a QR scan to invoke the

process. But from there on the phones take it then we don't

need the older systems to have all the bits and pieces they

just need to be able to say, Yep, this is you in the same

exact way Dave that username and password would say, Yep, this is

you.

Okay, now, you mentioned FIDO. What is

FIDO is a protocol that began about 10 years ago,

FIDO?

to help take physical token keys, like almost a USB sticks,

and put a private, public key on those things in order to

authenticate. It's just that now every phone in the world has

that capability. So while I appreciate the efforts done

there, and I do think they are used in many cases that you

can't enter a phone into a secure room, totally get that,

for most consumers and our parents, the key is not to

change their UX (User Experienc ); if they log in into their

phone everyday by putting their fingerprint or if they are usi

g their face. Let them also i entify their true persona by doi

g the same thing, especially w en the underlying technology is

exactly the same. So I'm proponent of not changing the t

boo, not changing the security behavior, because then you

have something to overcome. L t's make it easy, ubiquitous a

d democratize it. Like we've de ocratized the use of F

cebook, right? or Instagram, ri ht? Let's use the ability of

having every form having biometr cs and an ability to store a cer

ificate to secure the identitie once and for all and st

p with the

Fantastic. So in the spirit of making it

easy, so it seems like we don't have to choose between

convenience or security, we can have the best of both the

worlds, right?

The answer is yes. And I know Dave, that many

people who are cynical will say, well, you say that. But

unfortunately, we have 60 years, 60 years of heritage where

security was always about adding another padlock to a door,

always. So management never wanted to add more security,

because it translated directly to more friction, which

translates directly to less sales. I mean, let's be honest,

if the marketing and sales people would control their

website, there would be no password, they'll just say come

in and buy something right. So that those two worlds always had

a friction. And when I was the head of Risk, it's one of the

largest credit card companies I witnessed this firsthand. I

wanted to help people stop being victims of fraud and ask them to

be more secure. It's just that in the very means I've asked

them to do it, they now get confused. And they forget what

the secret was. So they call me to tell me I got stuck. So it's

almost like you've given them enough rope. And they'll hang

themselves, right? Today, we live in a world where I love the

fact that the main platforms like Samsung and Apple and

Google have made it so easy to use biometrics, and have put it

on every phone. And all I'm saying is like why not harness

that ease with great security. And yes, you can have the best

of both worlds. But you couldn't say that 10 years ago.

Very true. Very true. Now the solution

sounds great. And we need to move in that direction. What

about the cost aspect of it? I've I've read that the cost

implications can be significant. Is there any truth to that?

So let's parse it down. I'll start I know this is

not a commercial, but I and other companies in our space,

encourage people to start with free solutions. Free as in not

even a contract. Go integrate the API (Application Programming

Interface) to your website, go tell people you can download

this app to get in. Just so you can see that the baby steps

could be taken today without any friction whatsoever because we

want the world to become passwordless right? After that,

if you have a brand issue and marketing and you want to do it,

as I said before, as a white label, yes, you need to pay but

to get going. Everybody who's listening to this podcast can

start Today, okay, so where are the costs? The costs are in

changing every time you train, let's say you have a company

with 10,000 employees. And up until now they've used username

and password and a an authenticator app with OTP (One

Time Password)? Yes, you need to send them emails to say next

month we're upgrading to passwordless, you will not use

this anymore. Here's how you will log in. Clearly there is an

adjustment period. And there might be some cost of people

asking questions, yes. But that compared to getting hacked that

compared to letting the bad guys win, that compared to every two

months, you get a call about I forgot my password, diminishes

completely. And that's really where the hurdle is. I don't

think it's in acquiring the software Dave anymore. It is all

about change management, and getting on a passwordless

journey, as we call it, because no one's gonna do a big bang

change and just change overnight. We don't recommend

that. But if you just change your desktops, and then you

change your SSO for the most part, no one's using passwords

anymore in your company.

Interesting, very interesting. What about the

regulations aspect of it, I was reading somewhere that --

regulations require clear information on data storage,

considering the sensitive nature of passwordless data when it

isn't stored appropriately, there could be a lot of issues,

would you? How would you react to this statement?

Yeah. First of all, I love the question. I'm going to

give the listeners an example of what does it really mean and now

how we're handling it. Say that we live 30 years in the past,

okay. And every time you come to inspect your vehicle, they need

to put something in your exhaust pipe to measure emissions, right

Dave? So you certify that you're not a polluter. Okay, now we

roll the tape 30 years, and the first Tesla comes off the

manufacturing. And they come to the DMV (Department of Motor

Vehicles), and the person there does not know where to stick the

thing to measure the emissions. So they might say, I'm sorry, I

can't certify you because my instrument to measure pollution

cannot be used because you don't have an exhaust pipe. But I hope

it is obvious to you and the listeners that: what do you

mean, this is like better than any exhaust ever, this doesn't

have any emissions. But there's a delta now between the forms

and the processes we've used in the past, which all relied on

having passwords, and the reality of no passwords. So I'll

give you an example. When an examiner comes to a bank and

says, Okay, I want to see that you guys are maintaining eight

characters and uppercase and but the bank says we don't have

passwords at all, like, we don't have them. So don't we don't

need to maintain them to belong. Sorry, that's a problem for me.

Because the process and the protocol, say your password must

be this length. You see the dichotomy. It's very similar to

a card, it doesn't have any emission, and you're trying to

measure its emissions. So the way we're solving it now, Dave,

is let CISOs (Chief Information Security Officers) keep any

password they want, it could be 200 characters in the system. So

when they examiners come, they say, Oh my god, you're the best

password I've ever seen. But in parentheses, no user is ever

going to use that. But that is really the period we go through

right now in order to appease the past, even though it makes

no sense anymore, right in a world without passwords. But we

don't want to fight it. We don't want to swim upstream. So we

just let CISOs store, whatever you want in your systems, show

it to your examiners. But your users will never need to know

this password nor use it and you as the CISO can change it every

week if you wanted to because it's now just a security gate.

It's not a usability hindrance or anything like that.

Okay, that's, that's very, very good

to know. What about privacy concerns? You think users, you

know, how would you alleviate privacy concerns amongst users?

Love that question. So going back to the fact that

we're using a public and private key, you can assign it to a very

long string that does not reveal the identity that can completely

be anonymous. But note that the only thing we can attest to the

SAML two assertion is like this key is back. But I can't say if

it's Dave or not, Dave. Okay, so that's the basic level, it could

be completely anonymous. And in fact, most of the hardware keys

we talked about before are anonymous, because you simply

don't know who purchased them. On top of it, we are big

believers in hanging an identity through the process of identity

proofing and it could be a minimum of email magic link. So

I'll send you an email you go click a link so I know you're

the owner of this link, all the way to a scan of a driver

license and checking the DMV (Department of Motor Vehicles)

that you really are who you say you are. verifying your phone

records. There are different services you can layer on top of

the baseline of just a certificate in order to know the

true persona. And that is key when you open a bank account,

and you need to go through AML (Anti-Money Laundering) and KYC

(Know Your Customer) checks, or you want to get your medical

records, and I really need to know I'm opening it up to Dave,

and not somebody who pretends to be Dave, right. So depending on

the use case, we can start with full anonymity all the way to as

much identity proofing as you want. But the core technology is

the same. And in all of these use cases, you don't need to

remember a static password. Wow.

Very, very interesting. All right, I keep

throwing questions at you, and you just address them so

effectively. Another question for you. So, you know, how does

passwordless authentication, you know, how, where does that

factor in, when it comes to multi factor authentication,

mobile multi factor authentication, how are how are

they connected?

Great question. In the past, we only had username

and password. And that is only one factor. And if you don't

mind, I'll give a primer to people who are hearing about

authentication for the first time. Now, there are only three

factors, something that you know, like a mother's maiden

name or a password, something that you are, which is usually

biometrics. So, template of your fingerprint of your iris

voiceprint and, or your face ID, or factor or something that you

have. And that could be a physical token, a document or

anything like that. So when you say multi factor, what you

really mean is that you have more than one factor being used

in the authentication. And to illustrate username and password

are both elements of something that you know, hence, it's a

single factor authentication. Now, if username and password

were really strong and secure and worked, you would never need

two factor, you will never need multi factor. Why? Because it

works. That's it. Because of data breaches, and everything

that you read in the news, having username and password

that is easily obtainable is just not good enough. And that

was the source in the early 80s, and mid 90s. To add a second

factor, and the poster child was RSA (Public Key encryption

technology developed by RSA Data Security) and their tokens that

change OTP (One Time Password) tokens that says, I'll give you

username and password, knowing that you could reveal them by

mistake to a fish or something like that. So now give you a

token that expires every 30 seconds. And that is something

that you have because it's a token physical possession. And

together, they created a two factor authentication system.

Okay. So how does it translate to the mobile phone? While a

mobile phone on its own is a token of something that you have

to factor something that you have, by the mere fact we placed

a certificate on it, we have high level of assurance that

this is the right certificate, because most of the phones today

have a biometric login into them, we can consider that as

something that you are. So face ID and the certificate gives you

two separate factors. It's just Dave they're not using the

original factor of something that you know, namely a

password, so we're still in 2 FA (Factor Authentication) or MFA

(Multi-Factor Authentication). But it does not use the single

factor of something that you know, like a password.

So, it becomes stronger multi factor

authentication becomes much more stronger and effective if you

were to go passwordless

correct. And to give you the example from before,

let's just say there's an organization and all their

customers passwords are in one database, if I breach that, I

basically got into all your accounts. However, if the same

organization puts a public key, and a private key on every one

of their customers phones, clearly the database doesn't

have those keys, because that's how PK (Public Key) works. That

means I'll have to go and hack one phone at a time, which I

hope demonstrates how effective it is. And that it lowers the

profitability for the bad guys, which is really what we're

after, to make it so difficult that they go do something else

and not try to hack the accounts.

Absolutely. Well, let's talk about the bad

guys. And let's talk about your motivation, what got you doing,

what you're doing, and all the great things you've been doing

and trying to reduce or fight online crime.

Our mission at Trusona is to curb online evil

and the funding of evil and I know it sounds very altruistic.

If you really track everywhere we put our software and what

happens after you see the attack rate goes down. What do I mean?

The bad guys who were there up to a week ago and could just

enter in with username and password, now get stuck. There

are simply no username and password fields to put in. And

they can't use their methods so they have to go elsewhere and

that curbs their funding. The way I got into it is, when I was

working at the large financial institution, I started seeing

how the crime happens, and who ends up benefiting from it if

you follow the money, and you'll see Dave, that losing the money

for the bank is not fun. But when the bad guys get a hold of

these funds, they use it for five things that are far worse,

like narcotics and human trafficking, and terrorism and

weapons smuggling and also child exploitation online. That is

what I'm after, when you see what evil is done with the money

that gets stolen, all of a sudden is no longer a job or

managing your risk on some excel sheet. It becomes a mission. And

I'm proud to tell you every Trusonaout that is working at

Trusona, part of their interview process, and part of how people

join this mission is to have that need to curb that, above

and beyond selling software to banks and healthcare companies

and so forth.

very commendable. I applaud your

efforts, I hope you continue to have great success. Along those

lines Ori, there are lots and lots of people out there who are

not very technically savvy, the level of cybersecurity awareness

around the world is okay, not great, based on my my experience

talking to the global community. So there's there's a need for a

lot of help. What tips or recommendations would you have

to anyone from protecting themselves from different types

of attacks? And I know this is a very broad question. And, you

know, it may not be possible to give a very comprehensive

response. But something is better than nothing. So give

some tips for our listeners.

Will do. So, let's take today, it's October 4, a

Monday that we're recording this 2021. In the news today, if you

load cnn.com, you'll see that the headline news is that

Facebook has been disrupted, okay. I assume that most of you

are Facebook users by design, or Instagram users. So assume that

today you were told, point blank, your account information

now resides in the underground is being sold. One way to think

about it is all is lost and our hair is on fire, and we can't do

anything. But everybody who listens to this podcast can do

one thing today, which will completely undo or usurp the bad

guys, change your password today, or as soon as Facebook is

up. I know you cant do it right this moment. But when you read

about the next hack, the next breach, whether you are a member

of that organization or not, that should be a very good

reminder for you to change your passwords. Why? Because the

moment you change it, who cares that the old ones were stolen,

it's like old keys to your house and you change the lock, it

doesn't matter anymore. Now I know some of you would say oh my

god with the rate of breaches today, I need to do it every

other day. Which by the way, is the very reason why we're

talking about this. That's why we want to get rid of passwords.

So as a society, we don't need to do it. But until the day we

really live a passwordless life. Take note, every two weeks,

every four weeks, every 90 days, just put a cadence to your

calendar just like you get a haircut then you go, you know,

to change the oil of your car, to change the password, at least

to your more important services like bank, healthcare, and so

forth. such that if the data will be breached, and I hope you

get the cynicism in my line, your data has been breached it

just you might know it or not. So assume that it was breached.

And by changing it, you are helping to curb the funding of

evil, just by switching the key and you can because it doesn't

cost you anything, again, it's just sheer will at this point.

It's not about money, it's not about difficulty, you know how

to change your password. So go do it. That's the first tip I

will give because then you are getting yourself out of the mass

hacks and you reduce the chances of you being hit.

Excellent. So changing your password is an

extremely important thing that you should be doing as Ori said.

Ori, if you could add a few other tips relating to how can

you have a strong password and what's the most effective way of

storing your password, though I, when people ask me, I say rather

than store try to remember; if you forget what's the worst that

can happen, you can, you have to go ahead and reset, that's

better than having it available somewhere that is accessible.

So, Ori, what are your thoughts about a strong password and how

best to store passwords?

Yeah, first of all, I want to agree with you and echo

what you said. One of the worst things I see people do is put

all their passwords in the password vault, and they protect

older passwords with a wait, here's a little sound. Password.

No, that's not good. How do you take all your passwords and

protect them with one password, that means if someone get to

that one master password, you have given away the keys to the

kingdom. Let me pause for effect. That is why I'm against

password vaults, because we're making it easy for the bad guys

to say you just need to guess one now in order to get the rest

of them right. So I'm not for that. If you want to create a

password that is both strong and memorable, again, I may go off

what most of the recommendations are, which is to create a long

password that is filled with letters and numbers. Those

suggestions have never come from human research. They've come

from very practical mathematician who said, this

will be harder to guess because of entropy. Now for all of you

who are CS students, yes, entropy is correct, but think

about your parents, they're a not a machine, they're not a

computer, the older they get, the faster they'll forget their

passwords, right. So we have to not keep propagating what

doesn't work, which is 20 character passwords with the,

you know, uppercase and lowercase, you have to give them

a different path to success. And clearly the password password or

123456 should not be what people use. So what I would recommend

is to use a passphrase. You can get to entropy, even though it's

less type of characters, but with more letters. So if you use

something like my password is my name, right, just that full

sentence, you have now made a password that may be 23 or 20

characters, but it's only a sentence very accessible and

does not have to have upper lower and a number.

Unfortunately, some websites will not let you use that

because of the propagation of forcing you with rules to pick

passwords that will be hard to remember, which will make you

forget them and call the service provider. So I know that's a

vicious cycle, that if you can pick something that is simply

long, that is pure sentence does not have to have special

characters that is way better than an eight character

password, that is with special characters.

Yeah, I couldn't agree with you more. So

having using a passphrase and changing your passwords

frequently and try not to store it anywhere. Because it's a myth

that if you use a password vault, people can't access

access it. People can, the server administrator has access

to that kind of information. So the less you put out there,

either on paper or even online, the better. Keeping it very

simple and keeping it jargon free. Fantastic. This was

fabulous. We covered a lot of topics. Now we need to do

something fun Ori, share with us that VC joke that I heard in one

of your other podcasts the other day. I think our listeners would

love to hear that joke.

How about I'll do this. I'll say I prepared the

different one for you today. I didn't even know you're gonna

ask, so I'll tell both and then in Edit, you can decide what you

want add. The VC joke goes like this, a man is in the hospital,

and he needs to go through a heart transplant. And the doctor

comes and say, Wow, you're in luck, we have three different

candidates to give a heart and all of them match your blood

type, so you can pick, so the patient says, Wow, tell me a

little bit about who the donors are. Says well, one donor is the

person who just died at the end of a race. They were an athlete,

everything about them is great, but they just had a heart

attack. So you can have their heart, says okay, what's the

second candidate, said the second candidate is somebody

who's very healthy, maintained a great lifestyle and just was hit

in an accident, said, Wow, that sounds good. Says, what's the

third one? Third one, is we got a VC, a person who's from the

venture capital community and he died unexpectedly today. And the

patient says, ahh, I want that heart for sure. And when the

doctor says why, why do you want that heart? He says, it has

never been used.

Love it, love it, and what's the other

one?

Okay, so I'll tell you now the second joke, which I

hope to tell today and to make it interesting and unique there

for you and your listeners. The husband is asking his wife

Honey, can you please remind me what did you set the bank

password to because I can't remember it? And she says, Are

you writing this down? He says yes I am. And she started

reading it. Mickey, Pluto, Rapunzel, and she goes on and on

and on., and then she says Washington, DC says oh my god,

this password is like 64 characters. Why did you make it

this, then the wife says, well, they said I need to use a

capital and eight special characters.

Love it, love it. Ori, it's been truly a

pleasure talking to you. Thank you for educating me and my

listeners and we learned so much today. We'd love to have you

back again to share more of your expertise and your thoughts. Any

final words to wrap up this session?

Ask yourself, why have you not pushed your service

providers to go passwordless? And if you're at work, ask your

team, why are we not prioritizing it? And start the

journey. I hope you can have some links to people who want to

try for free to start. I hope today, I'll say send me your

resume in a fax, you'll think that it's crazy. I hope that

using a password will be just as crazy a few years from now.

Thank you again Ori, it was a pleasure

having you. A special thanks to Ori Eisen, for his time and

insights. If you liked what you heard, please leave the podcast

a rating and share it with your network. Also subscribe to the

show, so you don't miss any new episodes. Thank you for

listening, and I'll see you in the next episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an AS IS BASIS with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.