01:54:00 · David Faugno
[01:54:00] S2: Just just when they need it, just enough with full visibility. It's the same primitives that apply to what we do for businesses even very large enterprises. But again, these are non deterministic actors. Right? They... You don't know exactly what they're gonna do even when they're well intended. Yeah. And there's so many ways for something malicious to be done as well. And so you have to reduce that standing access. One way... One of the ways you reduce this is you don't give it out. Yeah. And so what we've done... What... Interestingly, all of the partners, it started with with Instinct and then quickly saw with MetaMuse and with and others. These partners we've been collaborating with for months now, they see it as well. People want to have that control and they'll only really lean in and use these tools if they know that there's this trust layer. And so we set this system up. We've been working for a long time on the primitives that allow that secret to never get into the model context. It's it's never in a file where an another agent can come and find it and do something else with it. It's just delivered for the agent for the task that it wants. And so you can scope that a lot of different ways. And we're working with each of those partners on the roadmaps as to what does that scoping and that control look like for the individual to exactly your use cases or the examples that you share. How long do I want to let the agent access this particular resource on my behalf and under what conditions. And so that's really the the basis of what we're bringing here is this trust layer that sits between, you know, the agents that would do work for you and and the people that are ultimately accountable for it. And we're just all in on it and it's been it's been great for our business, it ultimately it's aligned with our mission.
01:55:33 · John Coogan, Jordi Hays, David Faugno
[01:55:33] S1: Do [01:55:34] S0: you do you think at all about, like, more proactive features and products for... On the consumer side that you could do around personal security. It feels like... [01:55:45] S1: Watchtower is kind of like that. [01:55:47] S0: Yeah. But it but it feels like now is a time where there's like a lot of activation energy from consumers of like, wanna do something, but at the same time consumers are lazy. And so it feels like you guys have gained so much trust. [01:55:58] S1: Like a gentic watchtower would be like, yeah, I did use the same password 25 times when I was in college setting up random websites. Like, go change those passwords for me. Like, that's a possibility, but it's kind of crazy. But I don't know. Is there to make a deal? [01:56:12] S2: You're you're obviously... We're right down the path on that. A lot of [01:56:15] S1: that is what we'll [01:56:16] S2: do in conjunction with our partners too. [01:56:17] S1: Right?
01:56:17 · John Coogan, David Faugno
[01:56:17] S1: Right? [01:56:17] S2: And so, and then... And what you wanna make sure from our perspective that we work really hard to do is all of that activity happens and preserves the zero knowledge basis of our vault. So we do a lot with confidential computing to make sure that when those secrets get decrypted, if they needed to be decrypted for a reset or otherwise, it's never in a place where a bad actor or an agent can find it and do something with it. So very carefully constructing that, but yeah, absolutely you'll see that come. The other thing that's interesting to Jordan to your question is, what happens with preferences? You know, people's preferences, they're actually looking to have more control over that as well. And your context is a is a broad term, but there's some things that look somewhere between a secret and and context Mhmm. That people want portability and control on. And so I think you'll see more and more of what we do in connection with our partners as well as providing some of that control layer at the one password level as well. So it's really an exciting opportunity, but like first things first, making sure that those secrets stay safe because what we're seeing in all the crazy security incidents that are coming up now is vulnerabilities are not stopping. It's so easy and cheap and fast to utilize AI from an actor's perspective to get into systems, to get onto somebody's laptop. [01:57:35] S1: And the
01:57:35 · John Coogan, David Faugno, Andre Haddad
[01:57:35] S1: And the [01:57:36] S2: first thing that they do when they're there is they look around and say, well, what access is standing around here? What can I get access to immediately by just getting credentials? So you can go all the way back to where, you know, the Hugging Face incident started to make its way into the public discourse to everything that happened this week. And it's, you know, case after case, credentials being found and compromised. And that's our mission. Let's get that get that cleaned up from starter, and then let's make sure that we don't propagate that problem as we use AI internally and and make the problem worse over time. [01:58:07] S1: What is the one password house recommendation for personal use of hardware keys? Yeah. So... Is that something I should be onboarding my family members to after I [01:58:19] S7: got them on [01:58:20] S1: one password? [01:58:20] S2: Hopefully, you use multi factor authentication. [01:58:23] S1: Of course.
01:58:23 · John Coogan, David Faugno
[01:58:23] S1: Of course. [01:58:24] S2: You know, it's interesting. You can ask your agents to to stack rank the different forms of multi factor authentication in terms of security. The agents will tell you that, you know, a hardware key is going to be the most secure. It's also got some challenges associated with it. Sure. I use pass keys for second factor all... As much as I can, which I think is a really good way if you don't wanna go to the hardware way. SMS is probably the easiest to be compromised. Yep. SIM swapping is a real thing and it's pretty easy to implement. So the bad guys wanna get in, think you're covered through MFA. So at a minimum, I would look at TOTP or pass keys on one level. But if you're really concerned, a hardware key is helpful. And then really just the other thing that people are doing is they're just sort of like getting lazy about it. Well, you know, I'll store it in my browser you know, variety of different ways. But like having that end to end encryption and having that just in time delivery where the secret is never exposed or can't be read from a file is going to be really important because the cost to attack is going to zero. That means everybody's a target. [01:59:28] S1: Yeah. Right before it
01:59:28 · John Coogan, David Faugno, Jordi Hays
[01:59:28] S1: Yeah. Right before it [01:59:29] S2: was just the guys that were were big enough to be worthwhile going after. Yeah. When when the cost is auto... When it's automated and the cost is almost zero, really any standing access is a potential problem. Yeah. And so you really wanna make sure that that central control point, you know, is is the is the way that your agents or you get access to the things that are most important to you. [01:59:49] S1: Yeah. It used to be the most secure way was just writing down a sticky note, putting it on the desk. But now the smart TVs have cameras. They're spying on you. And so they'll see from the camera the pic... The picture picture of this of the sticky note with your password on it. And so there's no there's no other solution. You have to use one password. It's it's it's gonna be bad for the sticky note industry. I I It will. Knock on effect. You're if you're really as successful as I think you're gonna be. Some money to be made shorting sticky notes. I love the industry but it's it's it's bad news. Bad news, but your building's good. But thanks so much for coming on the show. Awesome. Awesome. Have a great rest of your day. [02:00:26] S0: Good stuff, David. [02:00:27] S1: Take you to the day. [02:00:28] S0: Thanks for the update.