We did one looking at login.gov, and it’s been nice to promote around the globe as one way governments can use it, but there’s a good story here for Taiwan to tell to governments, so we’d love to do that.

We did a similar one a few years ago for, in the US, login.gov, which is…won’t quite call it the single sign on system, and it’s not used everywhere, but they aspire to. login.gov and Yahoo! Japan, I think, were the first two big sites that scaled to work with ...

One of the things we do, actually, in the Government Deployment Working Group, that Karen chairs, is case studies from different governments across the globe. We think it’d be really interesting to do a case study on what you all have been doing with FIDO here, if you’d be interested ...

We were talking on the way over here. One of the things that’s been eye opening this week, we’ve been aware for some time of the great ways that you’ve been using FIDO in Taiwan.

We’re of like mind on these things, that’s good.

If you read Moxie Marlinspike’s blog of about a year ago, they’ve been playing around with web3. It turns out it’s just new middlemen.

Yes.

The ability to sync them, while it’s a little less decentralized perhaps than some of the purists would like to see, makes it much more usable for everybody else.

It’s also been interesting to me, the emergence of passkeys has been a reflection of the reality of how difficult it is for people to manage private keys. This has, I think, been a reason why a lot of Web3 initiatives with identity, or cryptocurrency for that matter, have been ...

That space still is not quite mature. A lot more work needs to be done. Certainly, if you guys are all involved now in Decentralized Identity Forum and other initiatives, I think it’s good to be advocating on that front, to be looking to leverage FIDO.

I’d say, within the Web3 ID community, we don’t yet have consensus. Some people are suggesting we should be using FIDO. Others are suggesting we need to come up with a new authentication protocol just for Web3 ID. As you might imagine, we’re very much, in this camp, not looking ...

Thank you for saying that, by the way. I’ve had that argument before, “Oh, it’s crypto. It must be secure.” Let’s not…

I’m still based in Washington, DC, still engaged globally on a lot of different things on the digital identity front. That’s essentially my role, but he’s the one who’s in charge.

A lot less work needed in Taiwan, obviously. You all have been quite out in front on all of this. From a standards, policy, regulatory perspective, we’ve been doing quite a bit of that. That’s part of why I’m here today.

There were a lot of regulations where pointed to either one time pass codes, they pointed to PKI. FIDO was something that was new and different. There’s a lot of work to do to run around the world and educate governments.

My role with FIDO — six years now, I think — has been as an advisor, helping them with government engagement across the globe, in part because — how’s s the best way to say it? — FIDO changed the paradigm.

No, I think Andrew covered it pretty well. My role is I used to lead the digital identity team at NIST and also led the Obama administration’s national strategy for trust and identities in cyberspace.

It’s similar to what we’ve talked about. Nothing’s hack proof, but how can you eliminate scalable attacks? Passwords, there’s millions, billions, that are out there. That’s scalable. If it comes down to, now I have to compromise a single device, a single set of keys, that’s a very different story. ...

There’s probably a broader conversation. We’d love to learn more about some of your goals. FIDO’s expanding beyond authentication into other things that touch on the identity, biometrics, and privacy side of things, so are there other ways that we could look to collaborate and perhaps provide some tools that ...