How to Build Trust in Tech: Integrating Human Presence with Secure Innovation with Anthony Maley (Vouch.io)

Hello everybody and welcome back to Build Amazing Things Securely. I'm Laura Bell Main and I'm your host for today's episode. And today we are meeting another friend that I met in a strange location. Literally this time, the Strange Loop Conference this year held in St. Louis. Sadly it's last conference, but it left me with friends and one of them is joining me today. So today I'm joined by Anthony from vouch io. And so welcome to.

Oh, hey Laura. Tha thanks for having me. And yeah, it was great to meet you.

Anthony, I know you from having looked at your beautiful conference stand and met you in person, but the audience at home have no idea who you are. So who are you? The human.

Yeah, great question and actually really relevant to, to kinda what we do in my day job. So my name's Anthony Mely. I'm the co-founder and CEO of vouch.io. Based in Atlanta and Georgia and the us but we have people all over the world and we build offline first. Shareable security framework that can be used to essentially establish human presence in a world that's becoming even more autonomous day by day. That's really what we do. In terms of me personally, I'm clearly not from the us originally from, moved to Belgium for 10 years, and now I've been in the US for 10 years. So my, my, my human trait is to keep moving south away from the cold weather in the north. That's been my whole life trying to get as south, south as possible to get away from the cold weather. In, in terms of our approach to life and and the company are very much entwined. The whole company's very musical whether that's listening to music or making music, e even my kids are very musical. Everyone in our team is very much like that. So I think there's a correlation between building really secure cool things and having a very musical geeky background there.

I have many questions now. Hang on, let's pick some things. Now. This is an audio podcast. So the wonderful people at home can't see what I can see but behind him he has literally a dozen LPs up on beautiful shelves. He puts my organization system to shame as well as some sports shirts and stuff. It's a lovely backdrop. He's done very well. And I can totally believe that your musical, looking at the room you are in. But I have to, I'm gonna ask, so firstly, if you wanna move south, I'm in New Zealand. We're as south as you can get. You should. You could do better than Atlanta. Plug for the southern hemisphere. If you are a techie, come join us down in the far south. But why Belgium? What took you to Belgium? Of all places.

Yeah, work, work really. So just, my, my background is like chief architect, Chief Technology Officer for some of the world's largest companies before we, we started vouch. Really just work. There's not so many big enterprises in Scotland, right? My,

so you chose an, a huge country in Europe, then

Yeah. Yeah. The biggest.

equally small.

The biggest company in the smallest country essentially was the approach there. And that set me down a path that led me here. But yeah, but Belgium was amazing. I've got to say. One of my favorite countries, New Zealand sounds amazing. Maybe we'll end up there in our journey south

Yeah, we have a lot less chocolate than Belgium,

That's a deal breaker for me.

Oh, there you go. So onto the technology because you've got some beautiful alliteration in your product description here, and I think I really wanna pick into what you really mean by this. So speaking nerd to nerd, you've got a lovely elevator pitch there, human presence, all these things, but what does it really do?

Yeah, great question. So what our product does is it allows us to endorse an identity that you already trust. We're essentially an identity company that doesn't give you a new identity, right? So we essentially try and endorse something that you implicitly trust. And as a normal consumer, normally that's your biometric on your cell phone, for example. So we can take a cryptographic view of that, store it in a secure enclave where it's nice and secure. And then we have our own blockchain technology behind the scenes that can create what we call like this graph of trust that allows us to be completely offline and verify that data that comes from our blockchain anywhere, on any device, any piece of software, completely without the need for internet. And inside that data packet, essentially that's what we call an entangled proof. Inside there, we can have all the relationships about who you are what company you work for, or what ownership you have over a car, or which property you own. Which companies endorse shoes? An employee I. Where you're allowed to access, what transactions you're allowed to do, what credit you have with a financial institution, how you consume that credit, which concepts you bought tickets to. All of that can be encapsulated in this entangled proof, and then we can verify that offline completely at the point of transaction on the devices we interact with. Again, no internet.

Alright. Okay. The audience will be familiar with the kind of split that I find when I see new technologies. I am both fascinated and I wanna know a lot more about this but I'm also terrified at the same time. And that's a wonderful thing. I think that's actually a really good response to any sort of new technology is to feel that kind of, that dissonance, that disconnect in yourself. Alright let's break this down. Let's talk about some use cases. Where would you need to use a technology like this?

So we started in automotive. Let's use that and then we'll ramp up real quick here. Automotive is an industry is, that's really notoriously difficult to get your technology into a production in market vehicle, right? So we've focused there to, again, get credibility for the quality, security and scalability of the tech. But what we do there is we assert ownership over a vehicle. So Laura, you're the owner of this nice new shiny Lexus. We assert that and we'll pick another brand for you perhaps, but

It would've been a mini team just saying they would've been a, something cute. But carry on.

you're you're brand new money, but you then, as the owner, have a certain amount of entitlements and one of them can be sharing that access with your partner or your friends, or, service technician, or if you want to use it for Uber, you may have a driver that works for you. You then are in control of who can do what with that asset, which in this case is a car, right? Being able to assert complete ownership and then use that to share in a very sophisticated way. And then the car itself is the thing that verifies that you're the owner or you're the friend or you're the employee of the fleet company that's using that car. So we don't need PKI, for example, everything is cryptographic without PKI. So it's not centralized in any way. But then. So that's the simple use case where we're actually using it in everyday life now is in financial transactions. And really the problem we're solving there is things like verified presence. So we know that Laura was in the store when she bought that new mini right. Or bought that new jacket, whatever that is. We know that you're actually there in a completely offline way. So we don't need the internet to do that. But we all also record that in a very immutable way, so we know that it was you. And then we can Really ramp this up so I can say, Hey Laura, can you go to the store and buy this thing for me so I can endorse you to use my credit on my account in this store? So you don't have to pretend to be me like we do today, where I give you my credit card and you say, yeah, honestly, I'm Anthony. You don't have to do that anymore. You can be Laura, but you have the authority. You've being endorsed by our Tech to actually perform that transaction.

That's pretty cool. That, that's really cool. There's lots of different attacks and different challenges that overcomes.

Yeah.

I'm, my brain's whizzing at a million miles an hour trying to think through them, but I'm sure you can articulate it much better than me. What are the kind of the attacks and the risks that go away using a technology like this?

Yeah. Fraud is everywhere in financial transactions right now. So for example, tap to pay is how we pay for almost everything right now, right? E even Apple pay is NFC, but it's still tap to pay. You hold your phone near something and it starts a transaction. Credit cards, the frauds for tap to pay. You swipe your credit card, you don't know if someone's taken a copy of the numbers, right? It's near impossible. Some countries are better than others, so you know, you have chipping pin, but again, that technology is not super secure. But it's better than mostly in, in America. For example, chipping pin's still not a thing, believe it or not in 2023. So there's many fraudulent attack factors just for Tap to pay with URec, we are inverting that. So we do what we call invite to pay. So we know that it's you. We know that you're at point of sale. And that could be anywhere in the store, frankly. But we can actually say, Hey Laura, you're going to buy this. We can push the payment request to your device, your phone. You don't need to hold your phone next to us. We can actually push it to you. We know where you are exactly in the store. And that's only if you allow that to, to be clear, it sounds a bit creepy and a bit terrifying to your earlier

I was about to say, the line just reared its head there. We'll come back

you can give permission for the point of sale and that, point of sale can be anywhere now. It can even be an online transaction to be honest, but. But you get permission to be recognized and EC recognizes you and allows the vendors to say hey you're buying this thing you, here's what we've agreed. I'm now going to push that to you because I know who you are. You've allowed me to know that you're a regular customer or you're a first end customer. Makes no difference. And then you can pay directly on your phone. And we can even do some really interesting, innovative ways to do payment as well. Now we can use existing credit card rails or we can do a direct store credit 'cause we know who you are. We know that you have available credit. We can just do a typical ledger type approach there as well. Now. Yeah.

Wow. Oh there's lots. This is very cool. I'm like, kudos. One of the reasons I run this podcast is I love, I genuinely am excited about technology and this is cool. It's. Hella creepy in places. We're gonna dig into that, but I think, you are talking about it in a very controlled way, which makes me think that the creepy line is probably being respected here somewhere.

Yeah the reason we're in this space is because it's becoming creepy. We have this phrase of making autonomous technology more human. And the reason for that is you look at the advances in autonomous technology. You look at AI technology, for example. We're literally in this arms race approach with a couple of major companies, putting the tech out there at a rate that we just cannot comprehend. Even the people making the tech cannot comprehend how fast it's growing. And everything has became language for those large language models, right? Even wifi signals. They can literally detect what you're dreaming about. If you have the right upper assets in your head, they can actually describe what your dreams were in language form, looking at your brainwaves. This is how advanced AI technology is becoming but everything's becoming autonomous in general. But we think, if we don't make that autonomous technology more humane and give it responsibility. We're in real trouble. And what Vouch is trying to do actually is do that. So you can imagine if an AI bot has your credit card number, knows your name and address, it can actually. Manage your patterns. It can look and say, Hey, Laura normally goes to this store at this time. She normally makes transactions of this amount, but she didn't do that today. And I've got all the data in the world now so I can see that. So I'm just gonna make that transaction because probably when she gets a statement, she'll think it was her right. And it's gonna be really impossible for you to deny that you made that transaction. So we are trying to make it more human by Having verified presence, we know that it was you. Even if it's an online transaction where you have to approve it, we know that it's you connected to your machine, right? We know it's you connected to your phone and we're forcing that autonomous technology to bring the responsibility back to the more humane level if you like.

This is really interesting. Back when I was like a baby security person, one of my mentors explained to me about tracking and logging and particularly, the sense that no action should happen in a system that you couldn't explain that there wasn't a log or a presence point for. And he flipped it for me because at that point I'd been I thought this was very adversarial. Hey, we were trying to prove that people had done things wrong and therefore, we were that kind of adversarial bad guy versus good guy thing. But. Actually, he flipped it and he said actually, by having this level of scrutiny, by having these logs and records, you actually protect people from the accusation that they could have done harm because the evidence proves that bad things could not have happened. It could not have been them. And this feels like the extension of that, that while you can't change the fact that there's all that data out there. What you are doing is using it in a way such that it would actually really very difficult to create a a malicious entry in that space to, to do a bad thing.

Yeah. Yeah. And it's exactly that point, really. And the reason we have blockchain technology is so that we can provide that immutable View of what's happened, right? So we know exactly who endorsed who to do what, where, and who actually performed that in a way that you can then dispute anything. So even if there was an attack vector, you could probably still prove that it wasn't you. Whereas we're headed to a place where it's just going to be impossible. These large language models are just a black box even to the people who make them, so we need a way that A human can have that responsibility that they both had for a long time.

Yeah, this links to some, there's some I'm gonna come back to something that you've mentioned about it being offline that I think's really important for us to dig into. There's one last thing I wanna dig into on this, and there's some law changes, I believe coming through Europe about explainability and ai and ensuring that any AI based decision that's made that there is a, an authoritative flow. Of how that decision was made so that if we did have to analyze it afterwards, we could say, Hey, this is why this decision was made and it that it can be held to scrutiny. This feels like your technology would enable that.

Yeah, certainly if it doesn't enable it, it would be complimentary to that. So it would take what good work has done there and be able to connect that all the way through, not just to, I. Transactions, but also physical access based on those transactions is the way we look at it. So if you buy an airline ticket, you know that's a commercial transaction. Laura made that transaction, but was it Laura that consumed the ticket when she boarded the plane? And we could link that whole event if, even if it was an autonomous transaction that you approved, you endorsed that autonomous transaction on your behalf to buy the ticket when it got to this price. Right? Which sounds like a really cool benefit of autonomous technology, right? But you want to make sure it can only do that. That one thing. And if all the logic proved that it performed those actions from the AI company in the correct way, we can then link to that to say it was Laura that, authorized the credit

did it.

and it was Laura that consumed the ticket for the event or the plane or whatever that was. So yeah, I think we can really augment that to make it a complete end-to-End story.

Oh, I can see so many applications of this. I think what you're doing is really very exciting, very. Universally useful. Let's go back to something you said a few times though, because I want, I think it's important that we talk about why that bit is important. So you've said a couple of times you didn't need the internet. Now I know most of us are horrified by the idea of the internet isn't there all the time. But talk us through that. Why is it important that a system like this can operate without the internet?

Yeah. Yeah, brilliant question. My favorite question about our tech, to be honest, there's a number of different aspects that make this vital for what we are doing, and not also where kinda where the world's going in this autonomous world. If everything's connected. For every transaction, can you actually trust what's happening? If you can't, if you can't see that you're not in control. If everything goes to a large cloud server and you get a result back, how do you know what's happened there? You don't really know. So what we're trying to do is make that a more local peer-to-peer thing. Whether that's you to another person or you to a device that you're interacting with, whether it's a transaction or a car or whatever. We want to keep that just between those two things. Nothing else is involved in you asserting your ownership or entitlement to do that thing and. The thing, being able to verify that you're allowed to do that and your identity is who we think you are, that's really important for us in this kinda autonomous model that we're trying to add more human elements to. It is remove as many attack vectors as possible. From a security perspective. But the other thing is just pure robustness. If you have a digital key for a car, the last thing you want to do is park your car three stories in an underground car park, and then come back to start the car and you can't access it because there's no internet.

I live in a small country, right? We have big cities that are really well connected and in between them is a lot of rural space. And you go up a hill, you go on a mountain, and yeah, internet is not a thing there. That's not why we go to mountains. Yeah, I can totally see why this will be important. 'cause the last thing you'd wanna do is have your car bricked essentially in a mountain pass, because you can't get into it.

Yeah. And also, offline transactions are usually taken on trust, right? So you swipe your credit card, eventually if you do this in a boat in the middle of the sea or in a store in the mountains, they've done no internet. They just. Trust you, right? They take that transaction, there's some interesting solutions around here, but generally it's a trust-based transaction. And when, then when eventually connect to the internet, you realize that, things didn't go as planned or someone else used your card in the meantime, that's actually happened to me on a boat, believe it or not. It's one of the few times I being affected by, this is in the middle of the sea. People use my card, brand new card, but one thing on that boat. And my card was used six times. But there's no way to know about that until you get off the boat so much later. But that's a really important aspect of it. But ev is, and I think you and I actually spoke about this, it strangely, e ev is such a an emerging tech that everyone will eventually have in their lives that is coming, right? Particularly here in the US there's a lot of investment by the government to make it happen. But how do you charge when there's no internet and that's a real problem. It means you can't put chargers where you need them, right on top of a mountain underground in a forest. Those kind of things. And it restricts EV usage. Or the solution is you have hide expensive fiber optic cables that have to run across the country to those rural places or remote places or underground, just to be able to use an app to charge a phone. And again, that's one of the key use cases of our tech is to remove all of that, right? Not just the access to charge, but also the financial transaction of that, and to be able to completely trust. As a user of that and as a company providing it.

So I love this. I love everything about this technology. I'm gonna do lots of thinking afterwards, I think, but I'm gonna have to ask about that creepy side a little bit more because I think it's really important that we have these conversations openly and we talk about these things. So the data set that, if. You, if you roll out your solution to all of these use cases, the data set that you are compiling sounds to me as a, an outsider, quite comprehensive. It's, that's a lot of moving parts, that's a lot of data points. How do you think about the controls you put inside your organization to make sure that's not used for evil?

Great question. Actually we don't Have any of that data is the answer.

Oh.

So for example, if you're using it for a financial transaction, we have a data packet, this entangle proof that tells us you have available credit, but it doesn't tell me what that is, right? Doesn't tell me anything about you, doesn't know credit information, none of that. So when the transaction happens, the. Point of sale device that you're interacting with or the other phone, whatever that is, it can verify that. And that's not something we store, right? We just do the verification of a, an assertion that was made. Credit company says, you've got credit. We can verify that, but it's all in cryptography and there's no data. And all of the data associated with that is held by those credit card companies or the store that you bought from whatever data you agree for those guys to have about you. And that's true of all of our use cases. So we avoid having data. Yeah.

I love it. You've my, my blood pressure dropped like three points just in, in that description. 'cause I, as a security person and engineer, I get a bit conflicted. But when you see potential scope and how much this technology can do, there's always that I. That risk that people will just take it to the extreme and, combine everything together and we've got the super tracking system and then it gets a little bit, minority report and a little bit terrifying. But no, this sounds, so the secret sauce here from a security point of view and from a risk point of view is don't store it to begin with.

Exactly. And the only thing that we store is cryptography, and it's only cryptography that can ever be reversed or used against you.

Wow. There we go. I feel better because, how much harm could you do with a bit of crypto I'm asking that facetiously. But maybe that will, that would be another chat over a cup of tea sometime. Look we've had a lovely chat today. I wanna make sure that we ran this up nicely. If listeners at home were wanting to find more about this technology and learn about what it does, where would they find that? And then what's the best way to find more about you and connect with you as a person?

Yeah the website is just the best place. It's super old fashioned now to have a website but essentially it's still the best place for both connecting with myself or the information around what we're doing. Vouch I is the name of the company and it's the name of the website, so super simple. Feel free to connect there. Happy to share as much information as people want directly as well.

That's fantastic. Thank you so much for sharing this today. I absolutely love kind of exploring these new technologies and the problems they're solving and some of the things that perhaps we wouldn't have thought of naturally if we hadn't been in this space. So thank you for sharing that. It's been really helpful.

entirely my pleasure. Pleasure, Laura. It's really enjoyed this. Thanks for inviting me.

Yeah, you're quite welcome. Okay. Team at home, you know the drill. Every little and subscribe. They help us feel like we're doing good in the world, or at least it makes my mom proud. So please do hit those buttons. If you have a guest that you would like to recommend, I. Or you are building a technology that is changing the world in some way, whether it's from fashion to FinTech health, to gaming, who knows? Then feel free to make a suggestion. We would love to have you or whoever you suggest on the show, and until then, keep building amazing things and we will see you next time.