Security Confidential S13 E4 Aaron Painter

Manoj (00:01.186)
Hello everyone, this is your host Manoj Tandon. Welcome to another episode of Dark Rhino Security, Security Confidential. Today we have another awesome guest joining us, Aaron Painter. Aaron has a fantastic background, he is an entrepreneur. He was a VP with Microsoft in China as well. We’ll ask him a little bit about that. He’s a bestselling author. He wrote the book, Loyal. And…

He’ll give us a little clue about what that was all about. And currently he’s the CEO of Name Tag Inc. And we’ll have him, which is a company that is looking at different ways of verifying identities. So very relevant to the current climate, to the events that have happened in the news. We’re honored to have you, Aaron. Thank you for joining the show. Really glad that you’re here.

Aaron Painter (00:58.69)
It’s an honor to be here. I’m a big fan of the show, so thanks for having me.

Manoj (01:02.19)
Oh, you’re being polite. Well, but no, it’s guests like you that actually make it material. And nobody wants to hear me, I can assure you of that. So let’s start a little bit. We always like getting the origin story because so many people are interested, just given the nature of the diversity of backgrounds of people coming into the field of cybersecurity.

Tell us how you got into this. Like what’s the story?

Aaron Painter (01:34.858)
Yeah, you’re right. The more time I spend in cybersecurity, it is fascinating to see how untraditional paths, I guess, people pursue to go into it. And in some ways, I think that’s so valuable because the bad actors often also have untraditional paths, often also new tools, particularly powered by AI and other things. And they’re using them to find clever ways around what an industry that we’ve all spent so much time now building, find kind of ways through it. So my background.

Manoj (01:50.026)
Yes.

Aaron Painter (02:04.526)
is his own path. I spent nearly 20 years living and working outside of the US. In February 2020, so just as the pandemic was starting, I moved back to the US. And it was this crazy time, as many of us know, for so many different reasons in our personal lives, but the world had moved digital and was very quickly, anything that was possible in person was suddenly only digital. And I had a bunch of friends and family members at that time who had their identities stolen.

Manoj (02:09.73)
Really?

Aaron Painter (02:32.062)
And I said, you know, I’m going to be a good friend. I’m going to be a good son. Like let’s reach out together. Let’s call on conference call, you know, let’s call these customer support desks and hotlines and try and figure stuff out. And when we called in, they would ask us these sort of silly security questions, which we would answer. And we quickly learned that someone else had called in before us answered those security questions using information that was tracked down online or LinkedIn or social media or data breaches even, and took over our accounts.

And so it was sort of shocking to me at that point that all the efforts in an industry that’s become so big around cyber, how are we not able to identify the human on the other end of a screen, whether that’s a phone call or a website or other things. We either had to be a better way to use technology to improve what otherwise was probably a very manual process of asking someone, you know, to come into a branch or to come into a corporate security desk. Like, you know, I did it my time at Microsoft. If I needed help and I was locked out of my account.

I went to a corporate security desk and they looked at my ID and they kind of reset access. So this problem that the measures people were taking to protect their accounts sort of was no longer working. And that just got me incredibly excited because I felt pain and I wanted to solve it.

Manoj (03:45.134)
Well, that’s, so you took up a cause essentially in starting nametag. And is this your first company that you’ve done?

Aaron Painter (03:51.734)
deeply personal one, yeah.

Aaron Painter (03:57.102)
The first one started, I was at Microsoft for about 14 years, and then I was hired by a large private equity firm to run a portfolio company they had that was focused on cloud computing. It’s a company called Cloudreach, based in the UK. We did incredibly fun things with mainly large enterprise customers thinking about how to use the cloud at that time as it was becoming sort of a mainstream tool. I was a sort of a scale up and was the CEO role. Then in deciding what to do next, I…

Manoj (04:05.966)
Woffenthal. Wow.

Manoj (04:18.455)
So.

Aaron Painter (04:24.074)
you know, had this great privilege of looking at a bunch of different roles. And it was just about the same time that I had this big personal moment. And I said, you know what? I don’t want to go work for another company. I want to go build a company that can solve this problem.

Manoj (04:36.238)
And you know what, if you could enlighten our audience a little bit on the thought with that, and then we’ll get into name tag itself. But because it’s a, you know, having a steady paycheck has benefits. You know, knowing how your life is gonna operate. Jumping into the world of entrepreneurship, there are degrees of uncertainty as to what’s gonna happen. The outcomes are not all, they’re not guaranteed, right? So…

What was your thought process in making that transition, saying, you know, I’m really not going to take a job. I’m going to…

Aaron Painter (05:14.274)
You know, I was very fortunate at Microsoft to be there during this period where we were still growing in so many new areas. And one of the big things that I got very involved in particular was growing to new geographies. And so I got very involved in leading Microsoft into new markets around the world. Ultimately became 31 new countries that we opened up sort of the Microsoft door. Who’s the first person? Who’s the third person? I mean, I spent a lot of time then in Brazil. I ran the Windows franchise and then ultimately in China.

Manoj (05:35.043)
Wow.

Aaron Painter (05:43.754)
and kind of building Microsoft’s enterprise and cloud business there. And so they were entrepreneurial things inside a big company and it was really a special time to be able to build new things. But I kind of got addicted to this concept of building new things and trying to find sort of innovation at the edge as opposed to what I think of as sort of scaling and refining businesses that might already be strong or be effective. So I kind of love that motion of it. And it is, nothing is predictable today.

give career advice to people sort of earlier in their career, you sometimes think, oh, you know, go work for a big company, they’ll be stable and you’ll have a stable paycheck. And none of that’s true anymore. And sort of the sort of risk everywhere outside, you know, maybe in Japan, if you work for, as I bought to a large Japanese enterprise, maybe it’s a bit more of lifetime employment, but even that’s changing. So I think there’s risk everywhere. And for me, a lot more of it was where can I find impact?

Manoj (06:20.174)
Great.

Manoj (06:32.299)
Yep.

Aaron Painter (06:38.842)
And where can I just work with people that I share same values with and a common sort of ideology or mission? And I’ve been able to find that in the team that we built at NAMETAC.

Manoj (06:48.462)
Well, you know, cybersecurity is all about risk, right? Now, having, so you picked the right place. If you’re comfortable with risk, this is the namesake industry for it, for sure. When you looked just having traveled to so many countries, do you see different attitudes towards cyber in say Brazil or China versus what you’re seeing here?

in Western nations that are heavy on the regulations. Is there any insight, I’m curious, that you can offer there?

Aaron Painter (07:24.746)
Yeah, I think the world of cyber often doesn’t see boundaries. And interestingly, regulations might help enforce good policies, just like a corporate policy, you know, this is an effective way to do something. But sort of the creativity of humans around the world sort of knows no boundaries. Right. And so much of bad or malicious activity or, you know, hackers is finding creative solutions around established ways of doing things.

Manoj (07:48.694)
Yeah.

Aaron Painter (07:50.73)
And so, and certainly in emerging markets in particular, there’s a lot of creativity, whether that’s in regions of Africa, regions of South America, Southeast Asia, certainly in China, there’s just this drive to say, you know, Eastern Europe, how do I do things in a different way? How do I invent? And you know what? That can actually make you a really effective bad actor if that’s sort of the life and career path you choose.

Manoj (08:13.058)
Yeah, and all those nations you mentioned are the source of a lot of cyber malfeasance. And it makes sense. I mean, I think, look, other than state sponsored things, there is absolutely a monetary gain to be had if you’re a bad actor. That’s undeniable. And it’s not hard work. You don’t have to go and dig a ditch.

You know, if you have brains and you can think, you know, a laptop can do a lot of things for you. So.

Aaron Painter (08:49.454)
Remote work has empowered all types of new jobs and workers. It’s also certainly given new tools, let alone, again, AI and actual new tools. But it’s given a whole bunch of new power to bad actors around the world. And frankly, we’re all seeing that and feeling it, whether that’s in richer developed nations or really any part of the world today. There are no geographic boundaries anymore.

Manoj (08:52.542)
Yeah. It is.

Manoj (09:02.254)
Okay, so.

Manoj (09:11.862)
Absolutely. Which gets back to a comment you made just a minute earlier about the traditional ways of verifying identity, where like at Microsoft, you went into the corporate office to verify your identity. Isn’t there a great merit in that approach versus all the flaws that we’ve seen with identity verification in an online manner? It’s not convenient.

for sure. But if you really care about security, is that not the best way forward? I want to ask.

Aaron Painter (09:51.338)
Yeah, I think that identity is a big word. And the more time I spend in this space, the more I speak with other companies and vendors. And identity means a lot of different things to people. And we all have different facets of who we are and different ways we might want to identify in certain aspects of our lives. Fine, great. When I think of identity verification, to be specific, I think of almost what that physical experience is. And it’s whether you’re going to a security office, whether you’re going to a safe, trusted space, like the airport.

You know, you go in, so the TSA in the US, they ask you for an ID, they look at you, they run it through a scanner, maybe to see if the document manipulated. They check your boarding pass, they put you in physical security, and you’re kind of in a safe buffer zone. You know, similarly when you go, you know, go to a conference or an event, you check in, they sort of verify you work where you work, they check your ID, they give you coincidentally a name tag maybe that you wear around your neck, and then you’re in a trusted space. Hopefully you can network, meet other people.

And everyone there knows you’ve sort of been verified. And those concepts that exist in the physical world, I would argue need to exist in the virtual world. And that I feel is a strong need for communities and platforms to at least know the members of those platforms, safe spaces, know their members, know the people that are there. We see that at the TSA, we see that at events, but yet you could go to a dating platform today and sign in or sign up with your quote identity that’s an email address.

Manoj (10:57.056)
Okay.

Aaron Painter (11:17.158)
or a social media account you created. And by the way, if you want to be someone different, you just go create a new identity, a new email, a new social media account. Those to me are not safe spaces. And I think the internet has to continue to evolve to create safe spaces online like we have in physical spaces.

Manoj (11:22.252)
Right.

Manoj (11:34.082)
And so what are you folks doing then at NAMETAC to make that, push us in that direction?

Aaron Painter (11:38.818)
We’ve taken…

Aaron Painter (11:42.57)
Yeah, we built identity verification for secure moments that matter. And at the moment we’ve really purpose built for particularly help desk in support environments, and it was sort of an out of the box way to verify the identity of someone with confidence. So, you know, sort of who the human is behind the screen and technology platforms have made a big, uh, sort of leap in what’s, what we’re able to do. And prior to name tag companies haven’t been taking advantage of them.

Manoj (11:51.531)
Okay.

Aaron Painter (12:10.134)
When I speak of platforms, I think particularly of mobile. And so the world of, let’s say, scanning your government issued ID, driver’s license, a passport, and taking a selfie is not new, but it’s existed primarily for regulatory purposes. It exists in kind of a know your customer or a KYC flow. It might happen, let’s say, when you open a new bank account and then that bank is doing a regulatory checkbox. Okay, we’ve done our compliance obligation. We theoretically know who this person is. We’ve done our best efforts.

Manoj (12:38.123)
Yep.

Aaron Painter (12:39.606)
But coincidentally, when you call to transact with that bank and make an account change, they don’t ask you for your ID again. They ask you for security questions. They ask you for answers to things that, unfortunately, could be easily found online. And so we said, how can we take that familiar end-user flow of a government ID and a selfie but do it in a way with higher fidelity? And our big breakthrough was using mobile phone platforms for that.

So 100% of the platforms out there today that ask you for government ID and selfie are browser-based. They’re web browser-based, which makes it convenient, but unfortunately it means it’s victims are open to things like injection attacks. You know, I’m using an emulator or I’m feeding in a fake camera, or often I’m maybe I’m using a deep fake, holding up a photo or a video. Maybe I’ve made a PDF modification of a driver’s license. Many of those platforms even have a convenient upload button.

Manoj (13:03.328)
Okay?

Aaron Painter (13:31.598)
You can’t quite go to Chai GPT today and say, make me a California driver’s license with this photo and name, but that’s not that much of a far fetch. And you literally click Save as PDF and Upload, and KYC platforms give it a green check. Our model is that we route people to mobile phones. And by routing to mobile phones, we’re able to take advantage of all the unique platform features in modern mobile phones. There are things like the 3D depth map camera that unlocks things like Face ID.

Manoj (13:47.822)
Okay.

Aaron Painter (13:58.594)
That is an incredible Z axis to be able to say, is this person human? Are they three dimensional? We’re able to take advantage of features like attestation, which is little known, but it basically means because the security features are so strong in these phones, we can make sure that the camera on the phone is the one being used to capture, let’s say the selfie image, as opposed to injecting another camera feed or a manipulated image. The gyroscope, there are so many advanced features in these phones.

Manoj (14:18.611)
Okay.

Aaron Painter (14:26.786)
that by routing to mobile, we can make a fast and seamless experience that takes advantage of cryptography in addition to ML and AI to replicate, in some ways make even better, what would be that in-person human experience.

Manoj (14:40.314)
You need a reference image though to compare. So, right, so you have, well, the phone camera is providing you all this great information, but you still need a reference image that says Mino just looks like this.

Aaron Painter (14:55.458)
That’s right. For us, we rely on a root of trust in that government issued ID. And so if we can ensure that, so the typical flow, let’s say you call your internet domain provider today, because six of the top 20 today are using name tag. So let’s say you call your internet domain provider and you say, hey, I want to make a DNS change. I want to change where my, you know, erinpatry.com points to. And they say, great, well, in order to make sure it’s you, I need to verify it’s a meaningful change. I need to make sure that you are the person. So they might say, hey, is there a convenient link?

Manoj (15:00.257)
Okay.

Aaron Painter (15:23.918)
through Slack, through email, through, you know, send you a phone number or text message. There’s no reliance on the SMS verification element. They’re just a way to deliver a link. The end user then taps on that link. And this process that happens from there almost feels like magic, where something that pops up is called an app clip on Apple or an instant app on Android. And it’s this unique feature that most companies haven’t used today, that it’s basically a full mobile native app that the end user doesn’t have to go to the app store to download.

Manoj (15:44.174)
Okay.

Aaron Painter (15:52.766)
It delivers over the air in a small package and just appears. The industry gets something that gets this pop up. It feels like it was in the phone and says, hey, can you in order to proceed, please scan your government ID and take a selfie. They go through that flow. They have two different screens of consent to make sure they’re comfortable sharing. And they say, hey, this company, let’s say this domain provider is asking for your legal name, maybe your age verification, let’s say you’re over 18 or over 21. If you consent, click great. It minimizes and that rep on the other end.

Manoj (15:56.77)
Okay.

Aaron Painter (16:22.262)
gets a high degree of confirmation in knowing who you are. So the user takes an average of 22 seconds, but the customer support rep suddenly gets this very high degree of fidelity in knowing who they’re actually speaking with in order to proceed with an account change. So it’s a mobile experience that feels like a modern mobile experience should with all the security benefits of that in addition to taking away the user friction that typically appears.

Manoj (16:45.874)
And are you verifying the number, that’s the mobile number on file as well to ensure that it is the right mobile number that it’s coming from?

Aaron Painter (16:55.52)
You mean that like the phone number or you mean like the driver’s license number?

Manoj (16:58.448)
So when you send the link and if I click on that link, is it then going to say, well, is this Minoj’s phone? Is this matched with the records that we have on file for the number?

Aaron Painter (17:09.814)
We embed SMS verification in that. So if you click on the link in the delivery mechanism SMS, it will give that rep confirmation, but to the same degree that you would with any other form of SMS verification, meaning that’s imprecise and not safe enough to rely on. So that’s kind of a nice convenience factor. We think of it though, more importantly, as just delivering the link. And the verification that’s really happening is saying, are you, is this image that we captured at the three-dimensional depth map and other things, does it match the image that’s on the government issued ID?

Has the government issued ID been manipulated? Does it match what we expect it to be? And we get to take advantage of all these kind of mobile phones, toys and tools, so to speak, to go through that verification process. So it’s agnostic to really relying on a phone number.

Manoj (17:53.174)
Have you seen or tested it with these really high fidelity masks that you can get made now?

Aaron Painter (18:00.726)
Yes, there’s a fascinating framework around this for presentation of tact of initiative, PAD it’s called. We have, we do, we meet those compliance standards. Interestingly though, we are sort of a step ahead of where those standards are written because most of those are designed around poor capture mechanisms, which is if someone uploads, holds it up to their webcam on their computer, can the ML detect that?

Manoj (18:17.422)
Okay.

Aaron Painter (18:27.322)
our architecture is so different that we’re able to improve our capture mechanism, meaning was it used with an advanced camera? Was it captured from a camera feed that we know is cryptographically signed to our app, etc, etc. And so we get an enormous, most unfair advantage in the quality of the feed that we’re getting in that capture, in addition to later the evaluation and assessment. So all this stuff just means by using mobile, we’re able to get a technological advantage that means you can do identity verification for security, high risk.

anti-fraud scenarios as opposed to just sort of regulatory check the box.

Manoj (19:00.486)
And is this only right now, you mentioned you’re being used in customer support or service departments. Would this not be, this gets rid of the password. Why can’t it be used on a general transaction basis?

Aaron Painter (19:15.986)
It completely can. In fact, in a way, that’s kind of how we started the business. We said, hey, the future is moving towards knowing who the user is. You know, can we replace the password with something higher fidelity? And then we realized actually one of the fastest paths to adoption. It’s actually one of our early advisors. Um, this incredible gentleman is a, the CISO at HubSpot, uh, the market automation company, he sort of said, Hey, I think this could be really useful. You know, they’re a big Okta user. For example, he said, we were happy with Okta for now. They’re, you know,

Maybe things change, but they’re happy with Okta, they’re a proud reference customer. He said, can I just surround my Okta instance, you know, and sort of give my help desk tools, maybe even automate some of those tools for the end user to have a stronger sense of the recovery channel. And it turned out to be a really great insight that a bunch of other companies have since obviously been very interested in. And all of that was pre-MGM hack, pre-scattered spider and kind of this crazy rate where in a wave that we’ve been seeing.

where the help desk itself has become the attack vector. And so we sort of said, hey, you don’t, we could replace your MFA, but that’s, let us surround your MFA and sort of fix the glaring gaps that exist. And we’ve just found that to be an incredibly kind of fast path to market. And frankly, a fast path to value for a lot of companies that are just exposed there today.

Manoj (20:31.498)
you brought up Okta, you know, now 100% of their customers apparently were affected by the latest customer support or service breach. What are your thoughts about that? Have you studied that scene? Would you guys have changed the process in any way?

Aaron Painter (20:52.342)
Yeah, the Okta attack is just devastating. I mean, it’s devastating for the industry, it’s devastating for us as users, consumers, and it’s just awful because it’s such a core infrastructure that we all sort of rely on. There are thousands and thousands and tens of thousands of customers. What’s particularly sad is just sort of how it’s compounded because in August when Okta issued this, what seemed like an innocuous blog post, oh, we think some of our companies might be exposed at sort of the help desk through these social engineering attacks.

Manoj (21:14.783)
Right.

Aaron Painter (21:21.302)
Then a couple of weeks later, we heard MGM, we heard Caesars, we heard Clorox, many of those companies that were exposed at the help desk. It started with Okta sort of acknowledging the help desk is the thread vector, right? In fact, Okta’s CSO, you know, David Bradbury came out and said, you should be doing forms of what they call visual verification so that if someone calls your help desk, they recommend you have a video call and, you know, sort of interview that person and ask them security questions before you reset their access. Okay. That’s, that’s.

Manoj (21:41.088)
Right.

Aaron Painter (21:51.138)
good guidance, but gosh, that is incredibly time-consuming, expensive, frustrating, a whole bunch of challenges with that. And so it started with, hey, there should be a way to automate visual verification. And OK, great, so that happens to be exactly our wheelhouse and what we do at NameTag. But it puts so many companies at risk. Then it got worse, because in September, they said, well, we had a breach of our own customer support system. And then in recent days, they’ve come out and said, well, that affects, to your point, 100% of our users.

And then David Bradbury again, no offense to David personally, but David then has come out again on behalf of Okta and said, by the way, this might make all the support reps in your company more susceptible to social engineering at the help desk. So now if you’re a bad actor, it makes it pretty clear. I mean, the MGM hackers went on LinkedIn, found an employee at MGM, called the help desk. Turns out they even got some of the security questions wrong. They still got in. Oh my gosh. But now it’s sort of, you know.

Manoj (22:20.48)
Yeah.

Aaron Painter (22:47.878)
not to coach the hackers, but my goodness, you would sort of target someone who might have had those actor credentials for the support system. Like, it’s a playbook on how to make something that’s bad even worse. And frankly, I’m terrified as we enter the holiday season when staffing levels are lower and we’re in the middle of just an outbreak, frankly, of cybersecurity that’s happening at the help desk. And I think Okta, instead of helping, has actually made it even worse.

Manoj (23:12.478)
Well, it’s, you know, one thing that it’s highlighted, and I think you said it is, or it’s implied, at the end of the day, it’s the human that got compromised, right? So it was, I think in the Octus case, it was, it started with a compromise of someone’s personal Google account, right? That led to an entry vector.

how do you take the human out of the human in this chain? Because if you think about it, I can, if I’m, we had a real CIA spy on whose life’s mission was to compromise human beings and get them to do things that would be totally illegal in their nations of origin. That was his job, you know? And he’s written a few very interesting books.

And he talks about the fact it’s really not that hard to compromise people, right? So is there a mechanism by which we take the human out of the human and make this so you can’t, that person is eliminated in the chain in some way. Cause I could yell at a, as an example, I could go yell at a customer support rep, Aaron.

get really aggressive with them. And at the end of the day, they’re human beings. They’re gonna be like, you know what? It’s the holiday season. I wanna go home. Hell if I care here.

Aaron Painter (24:52.262)
I would argue it starts by giving humans better tools. And if you’re a bad actor human, if you’re a malicious bad actor, you remember even of this scattered spider group, you have pretty great tools right now. In fact, you have pretty great AI generated tools, deep fake tools you can go do. The pace of AI right now, unfortunately, is benefiting bad actors better than it’s helping us on the defensive side. And today, if you are a support rep, you work in a help desk, you probably like technology, you probably like people, probably like helping people.

Manoj (24:56.544)
Okay?

Aaron Painter (25:22.434)
You went into this business and say, how can I help? And instead of starting any conversation on chat or call with, hi, you called. Clearly you’re in distress. Something’s wrong. You need something. How can I help you? We have put them in the role of identity detectives. And their job is to begin a conversation interrogating you on who you really are. And if they do a good job and really make sure it’s you, so to speak, well, then you’re probably frustrated or upset. If they do a bad job, by the way, their company might be exposed and they’re probably fired.

Manoj (25:39.432)
Yes.

Aaron Painter (25:51.578)
It’s super unfair that we have not given people in these support rules tools to be good humans, right, to be able to do their job in a thoughtful way. And so I would argue we need to start by giving these people better tools to evaluate who the human is. And then yes, there are other ways to automate some of that work so that, you know, maybe you as an end user, for example, could verify your identity remotely, it could automatically trigger a reset of Okta or Active Directory or Duo, so you didn’t need to call the help desk.

Manoj (26:16.378)
Right

Aaron Painter (26:18.614)
But we need to do both and the fastest way to start. And frankly, the crisis right now is to give those help desk reps better tools.

Manoj (26:27.622)
What about the cases where the help desk reps are compromised themselves in participating with the bad actors? And the example that comes to mind here is there was a huge Bitcoin theft of a gentleman in California. And he ended up actually, what happened, they did a sim swap, you know, essentially the,

It was a bunch of teenagers out of New York City who paid off a major telco rep 500 bucks to just move the number from one phone to another phone. Right? And as it turns out where the courts ruled was that the telco has no financial liability to the person whose money was stolen to the tune of $20 million. Your thoughts or comments on.

Aaron Painter (27:22.25)
Yeah, we spend a lot of time with telcos. They have a, I would argue, a responsibility, frankly, to the society right now, because so much of 2FA, two-factor authentication, relies still on SMS verification. Obviously, we all know that is not a secure channel, but that really relies on those telcos being good at identifying the people that call up and want to change their phone number. And it’s sort of the front line of attack that Scabbit, Spider, and other are using now. It’s too easy to do a SIM swap.

I got a new phone, can you move my phone number over? And again, that’s a help desk rep, a customer support person at the telco who has no idea who you are. And they have to go through this identity detective process to say, well, all right, it seems like you’re the account holder, let’s move that phone number over. And if they’re not good at it, everything downstream that relies on it puts you at risk. That’s also an incredibly hard challenge for those companies because they have not given their support reps proper tools to do it.

So you see as a lot of the telcos experimenting with different things, some of them saying, well, you must go in store to a branch or to one of our retail stores. Those to your point, we’ve learned a lot and I have to tread carefully here on where I stay with public information, but that process is also incredibly flawed, partly because of what you said, it’s too easy to slip that person a couple of bills of cash. Some of the telcos have moved too well, let’s have two people in the store verify, let’s have the store manager verify.

Manoj (28:26.804)
Yeah.

Aaron Painter (28:49.746)
All those things, I would argue, are a tools failure. Because we haven’t given them digital tools to use, let alone auditable or trackable tools, we’ve sort of made it too easy, and it’s left up to some human judgment without any sort of robust tooling behind it. And so the telcos are exposed, and then anyone who relies on SMS verification downstream for security is fully exposed.

Manoj (29:13.274)
Oh, absolutely. I mean, SMS is a huge flaw in get rid of it. But that’s a that

Aaron Painter (29:22.866)
We love texting with our friends. It is a great social channel Now you get actually a whole nother fun category of like hey I got this random SMS someone pretending to be my boss or this or my you know our new hire And you know it’s becoming a fishing angle and a whole bunch of other crazy things again because you actually don’t know the sender of those things You know the identity is not verified in the person that sends we do we do a funny Well, we do it internally even but we know a lot of customers do the same. You know, we’re some you know

someone on my team might get a text, oh hi, it’s Aaron, I’m something this, I need your help, can you look up this and send it to me or go buy gift cards because I need it for whatever. And so that our team is trained, obviously, we just send name tag verification. Sure, no problem, per company policy, please verify your identity. And the moment you throw an identity verification link in there, that thread stops. And if it’s legit, obviously the person would verify who they are and you’d feel comfortable to move forward.

But SMS has value, it does not have the security value that we need today as an industry.

Manoj (30:24.958)
Yeah, I would, there’s no argument there. I mean, I don’t think you’re gonna get too many people in the industry that would put up an argument. There’s the argument of convenience, because it has, but the reality is every one of us has their identity has been compromised. I bet if I went looking, Aaron, I could probably find your social security number, your address. I mean, everything that anybody typically asks for.

In fact, I could probably open a bank account sitting here virtually with your name in it. At least I definitely know I could. And it’s, if introducing what you’re saying would definitely put, it would make it very inconvenient for bad actors to actually commit the frauds with the relative ease that they’re able to do it today. And any, yeah.

Aaron Painter (31:24.974)
You’re spot on. I mean, you know, anecdotally, we as a company, we banked with Silicon Valley Bank pre their crisis earlier this year. And you know, afterwards, obviously, we quickly moved to a bunch of different banks and set up a bunch of new bank accounts pretty quickly. We’d won very large, you know, top three banks, shall we say. And they were very wonderful with us and kind and they set up an account quite quickly. And part of that was a KYC process, not only in the company, but as me as an individual, you know, I emailed in a PDF of my driver’s license or whatever. Great.

Manoj (31:24.992)
Sorry, go ahead.

Aaron Painter (31:52.606)
And then they said, your account is now open, but in order for you to access it, we need to set up your online banking. Don’t worry, we use an authenticator app, which turns out many banks don’t even offer that. But great, I was so happy and I knew that was one of the things I liked about the bank. And they said, hey, but in order to get you set up, it’s gonna be a three week wait so we can have a Zoom call with you to set up your authenticator app. So they were doing visual verification, which actually made sense.

but it was a three week delay. And then three people showed up on that call, by the way, didn’t ask me to even hold up my ID, didn’t ask me any verification questions in that. And they helped me set up the authenticator app. It’s like, great, now I can access my online banking. And so I said, so what happens now if, by the way, I get a new phone or I get locked out? They said, don’t worry, we just send you an SMS to your phone. The loophole in all of these things, it turns out MFA has all these wonderful strengths, particularly in ideally in.

Manoj (32:19.379)
Yeah.

Manoj (32:39.159)
Well, that.

Aaron Painter (32:47.222)
forms like an authenticator app, as opposed to, say, SMS. But it has this loophole around recovery. It also actually has a loophole in that illustration around enrollment. Now, how do you make sure you’re enrolling the right person, the legitimate account owner, in the MFA? But then what do you do when someone claims to be locked out? And if you don’t have methods in place for either or both of those, all your efforts around MFA are anecdotal. It’s simply too easy, then, for someone to come in kind of in the side or the back.

Manoj (33:15.798)
Yeah, that’s a giant flaw. Why do you think organizations as sophisticated as a bank haven’t QA’d those things? Or what’s missing? I mean, to me, you pointed out an obvious flaw in the recovery, right? And even in the enrollment. Why do you think that’s happening?

Aaron Painter (33:40.578)
I think for many ways the technology really wasn’t there. The ability to do a digital KYC process in browsers is roughly 10-ish years old technology. There are a bunch of players in that space. It used to be manual. You would email in a copy of this. Some outsourced team would look at it. Only in the last three to five years did technology come out that said, oh, we can automate that process. You don’t have to go to a human to look at it. But they’re all browser-based.

This concept of using mobile technology, and let alone the delivery mechanisms like App Clips and Instant Apps and all these things that we’ve been able to sort of piece together, it took invention of new tools. It’s new patents on our side. This is new technology, but the technology is there to use. We have these mobile phones that are incredibly advanced. The pieces were there, but they had to be put together. And so I would argue that this needed innovation. It needed invention of new things. And that technology now exists.

You know, in our world, it’s been exciting to see, I think, how many companies are realizing they can look at options. And, you know, frankly, just very candidly, our business was doing great this year, and then MGM happened, and it’s just been wild. Everyone is realizing they’re exposed, and companies are coming and looking for solutions, and then coming back and being like, hey, I looked around, and you’re kind of the only game in town right now to protect my help desk. And by the way, you seem great at it.

And we’re just, it’s been a really exciting time. And frankly, we are grateful that we can go help and that we have such a fast way to help companies just try and shut down this risk factor. More companies need to step up and build similar technology, frankly.

Manoj (35:15.499)
That’s fantastic.

Manoj (35:19.778)
right place at the right time. That is a foundational thing of entrepreneurship. And you guys are really adding value. I mean, with what the process that you’re enabling the implementation of, which is, that’s fantastic. We’re, you know, that’s absolutely fantastic. On the cell phone cameras, a question for you. Are you, have you guys thought of like using…

not just the mapping of the facial features, but I think the iPhone now has an infrared camera to actually map the blood flow patterns and say, you know what, a mask can’t fake that. That’s a really tough one, because your vascularization is pretty unique to you. I’m curious, has that been thought about? I’m just curious. Maybe that was a stupid question, but.

Aaron Painter (36:07.062)
Yo!

Aaron Painter (36:12.65)
No, it’s not at all. One of the difficult balances is, we really feel like when you remove user experience friction and you can improve security, open up a whole bunch of new scenarios. But the challenge is how do you stay universal? And there are a lot of interesting conversations in identity verification that are very forward looking. Decentralized, crypto based, scanning someone’s iris, interesting things. The challenge with a lot of those is how do you secure enrollment? How do you make sure you’re scanning the right person’s iris?

You know, like face ID in your phone. So people, oh, I have face ID. Yeah, but it’s only the face that you enrolled when you got the phone. And by the way, Apple has no idea whose face that is, which is why, you know, there’s this Wall Street Journal article in February where his dad in Florida, I think it was got locked out of his iCloud account and he’s like, look, I just want the photos of my kids, you know, he offered Apple $10,000, he offered to fly to Cupertino, he said, why can’t you unlock my iCloud account? And he said, you have my face. And they said, well, that’s face ID. That’s not the same thing. You know, it’s, it’s how do you take.

technology and make it universal so that when you’re calling that help desk, you’re not 5% of the population that has the camera that can read the blood flow patterns. How do you make sure that you’re universal enough that anybody can use it? And by anybody, I mean people with IDs in the developed world. There’s always still a subset, but we try and focus on how do we get the most number of people able to go through a secure flow. And so we have to balance, how do you use like the newest tricks and gadgets and toys and how do you put them in? Maybe optionally, how do you learn with them versus,

How do you still have a secure experience that doesn’t require the absolute latest, let’s say, in hardware? And so we found a really good balance on that, but it is a really hard one. How do you adopt something new and still allow for universality in a way?

Manoj (37:54.943)
I’m sure 10 years from now, maybe that will be ubiquitous as things go. But that’s it remains to be seen. I mean, I think as you rightfully you guys invented something new, I think we’re going to see an evolution. Is there anything in the form of government regulation? Do you think that government could do to expedite the evolution or help?

in this evolution and forcing an adoption of more secure methods? Any, do you have any thoughts on that?

Aaron Painter (38:29.614)
Yeah, there’s so many different layers where government plays an important role. And, you know, I think the early White House order, executive order a couple of years ago on government enforcing MFA across government organizations was helpful. But again, they didn’t yet specify shutting down the risk factors like at the help desk in the recovery process. So that’s something where there’s probably room for sort of updates there. You know, on the privacy side, we are enormously privacy oriented and privacy centric.

both in what the end user shares and holds and what the company needs to capture and what they need to store. Privacy regulations today are very much scattered. You know, in the US it’s very much certain states, certain states then kind of imply national compliance if you wanna be operating across the US or not yet in a place on federal regulation there. But I think the stuff that excites me the most actually from a government perspective is actually national government ID schemes and programs.

Manoj (39:00.75)
Sure.

Manoj (39:14.035)
We’re not.

Aaron Painter (39:20.918)
You know, India is a really classic example of that. What they built with Adhar is world class, certainly room to improve and ways to go from there.

Manoj (39:30.01)
Oh my God, I can tell you about that. They’re they unfortunately left. Again, I don’t think those guys were doing user testing, but that’s, but it’s a concept there. The concept was on sound footing.

Aaron Painter (39:45.066)
Yes, and the digital ecosystem is able to grow on top of that now, and locally in India is awesome. But what we like about AdHAR is, to your point, we require photos. We use photos and we use your selfie to match against something. And one of the neat things about AdHAR is we can actually query the government database and say, send us your encrypted enrolled photo and compare that against the selfie that we capture. And that’s a really neat advance because it means you don’t have to rely on the quality of the physical ID, let’s say.

An Aadhaar, it can be a printed piece of paper, it can be a laminated this or that, a QR code. And so you scan the QR code, and you’re not relying on the quality of the document, you’re then relying on the verified information you get back from the government database to do the verification against. So things like that are awesome integrations. It’s caused us to, we’ve really doubled down, and for example, in India, working well with Aadhaar, but other governments that adopt digital ID programs, it’s really neat and valuable for everyone when you can integrate into those.

and benefit from the level of security they’re bringing to that.

Manoj (40:43.282)
You know, the thing with Adhar is, I’ll give, there’s several gaps, but one that just comes to mind and is nobody, there’s no way to remove anybody from it. You know, once you’re enrolled, you’re in. So, and that identity is always live, which is one of the dumbest things I have. I was like, what was someone thinking? So if you look at the database, there are a lot of dead people

that are still living inside that system. Which means as a bad actor, if I wanna compromise an identity, man, that’s a treasure trove. I mean, I’m not gonna, I’m sure, I’m not gonna give away how to. And.

Aaron Painter (41:30.338)
Well, no, it’s important and it’s one of the core elements in how we are conducted. So we leverage AdHAR, but I’d say we fill its gaps quite nicely. So let’s say that’s a dormant account, take your example. It’s dormant account, someone is no longer there and someone’s trying to take advantage of that. And we see a lot of fraud attempts that people are trying to use obituaries, obituary photos, my relative who passed away. But we need a modern living selfie to compare against what we pull from AdHAR.

And so this concept we call selfie re-verification is really critical to our security infrastructure and something we’re able to uniquely do, actually the core of a patent that we’ve created around comparing selfies to earlier selfies back to the government ID and the root of trust source. So that even if you were able to say, hey, this is my AdHAR account and it’s not a real person or someone living, you still say, great, let’s see a modern photo of you at the moment captured in a really secure way to compare that against. And that’s a very difficult thing for a bad actor to be able to piece together.

Manoj (42:28.29)
Sure. For people who are actually using your technology, but there’s a lot of people that are using that card that have are not using your technology, unfortunately.

Aaron Painter (42:32.526)
Correct. Generally odd hover has.

Aaron Painter (42:41.046)
100% and same with disclosure privacy wise. I mean, the fact that you sort of even put your fingerprint on entering, boarding the train, doing a bunch of things and suddenly all the information that is conceptually available to the person you’ve given it to. There’s no selective disclosure. We call that privacy masking. It’s a great, great first step, but there are so many levels that they could take it from there and there’s innovation happening there, but it’s, um, platforms like that, I think are a helpful thing to see in governments.

Manoj (43:06.134)
Yeah, I mean, the idea was not a bad one. I wanted, you know, before we run out of time, I want to get to your book, Loyal. We didn’t even talk about that. Give us the, what motivated you to write it? What’s it about? And give our listeners a little bit of a synopsis here.

Aaron Painter (43:24.534)
Yeah, you know, what motivated me was actually working in China because I had all these large Chinese companies and organizations that this China’s boom time, so to speak, particularly in tech, and they were hungry to learn from best practices outside of China. And so I came to China, I initially didn’t speak Chinese and I learned enough to get around. I’m so far from fluent, but they were like, oh, foreign guy, come talk to us. I was almost humbled by how many people were willing to chat with me, but partly it was self-interested. They wanted to learn from practices from someone who had lived and worked in a lot of other countries.

So it was actually clever. They said, great, teach us that, tell us what’s working, give us your perspective. And so there’s so many questions around things like that. One of the topics that came up a lot was around culture. It was around culture within my organization. China’s economy was booming. Employees were going to work for a company, their company was training them, they were quickly then leaving to work somewhere else. Customers, there’s more competition for businesses, so customers weren’t necessarily staying with their provider. And so this concept of loyalty came up a lot.

And so I went back and really thought about and then engaged with a bunch of great firms and companies I’d worked with around the world to say, Hey, what does work and where have I seen successful examples? And one of the strongest was in this concept that, you know, Warby Parker actually is sort of inspired at the eyeglass company in the US and spending time and watch a great customer support or service organization. And when you watch how an employee starts it at Warby, you know, day one, first week, it’s

Manoj (44:24.386)
Okay.

Manoj (44:40.406)
Die, go FB, yeah.

Aaron Painter (44:50.69)
tell us a story about yourself, express vulnerability, sort of build trust. When you watch those people that work there, that are on the phones, for example, they know that whatever feedback they hear from customers, their manager cares. And they know that their voice is heard internally. And so they feel valued as an employee and they carry that culture to when they engage with customers. Because they’re hunting for feedback. Oh, oh, great. Oh, thank you for that insight. Because they know if they go pass it along, their management’s gonna care, their company’s gonna care.

And so this concept was that there’s this virtuous cycle between creating a culture where employees feel listened to and how that then carries to customers. And then you can create loyalty sort of across both demographics. And that was the crux of the book.

Manoj (45:34.275)
Man, you could have an immensely successful company if it’s a services-oriented organization, if that concept is implemented well. Because everybody wins, right? The customers want, they want to be treated like gold. The employees want to know that they matter. And, but it’s a tough one to do, you know.

Aaron Painter (45:42.978)
Thank you.

Aaron Painter (45:58.015)
simple things in some ways, but you know, some people do well and a lot, unfortunately, don’t. And so that was the goal, sort of let’s share things that are working.

Manoj (46:05.486)
You’re being polite again, but yes. In saying that, yes, I would agree with you. There’s a lot of people that don’t do that well. And there’s a lot, but the positive side is that leaves room for improvement, so do that. Hey, Aaron, we’re at the hour here. I wanted to give a couple of minutes here for you to plug or anything that you want or let our listeners know about anything that you have going on that you want to make them aware of. The floor is yours to talk about whatever you want for.

couple minutes here.

Aaron Painter (46:35.126)
In that same spirit, I love to listen. And so, this is thank you all for spending your time mowing the lawn or cooking holiday dinners or gift wrapping or whatever you might be doing to kind of listen to us chat. But I love hearing what’s on each of your minds. Clearly, if you listen to this, you’re interested in security, so am I. So please reach out, please engage in social media, LinkedIn, I love that. We try and create a bunch of relevant content, comment on the news, talk about things that are happening. So, you know.

Check us out, get nametag.com. Certainly, again, me on LinkedIn in particular. And I guess my big ask would be, please, if you are responsible at all for security in an organization, this holiday season is a particularly risky one. We are in the midst of a wild outbreak of attacks, particularly at the help desk, people using social engineering attacks. And the holiday is the worst time.

It’s when people are going to call, it’s when they’re going to actually be locked out, it’s when impersonators are going to try and take advantage of and sort of infiltrate your systems. So please, if you haven’t yet, do a penetration test, get the help desk, understand where you might be exposed and think about ways to help remediate that. This is a very dangerous holiday season and I think we all have a responsibility to do what we can to sort of stop these bad actor groups.

Manoj (47:54.602)
I, that is a very sage advice, and we want everybody to have a safe and happy holiday. So listen to what Aaron is saying. And, you know, there’s some common sense things there, and we’ll put links to your LinkedIn, Aaron, and to your company in the show notes. So if people wanna go and check you guys out, and read about the articles you guys push up there, that would be, you know, we’ll let them do that.

It’s a good offering that you guys are doing. Thanks for advancing our industry a little bit.

Aaron Painter (48:30.574)
Thanks for having me. This was super fun. I really enjoyed the conversation.

Manoj (48:33.47)
It was a lot of fun. And you know, as you guys advance, don’t be a stranger, let us know. If you’ve got a new advancement that you guys are putting out that you think is worthwhile to let everybody know, absolutely, you’re welcome back, come back. Let us know about what’s going on.

Aaron Painter (48:48.43)
That’s awesome, I appreciate that.

Manoj (48:50.591)
Okay. Thank you, Aaron.

Aaron Painter (48:52.322)
Thank you.

Manoj (48:54.19)
Take care.