Passkeys might really kill passwords

Welcome to the VergeCast, the flagship podcast of video podcasts. I'm your friend David Pierce, and if you're watching this on YouTube, there's a decent chance you're noticing something slightly different for one of our Tuesday episodes, which is my face. So we just finished moving the show from the VergeCast channel to the Vergeist channel, and you should stay subscribed on the VergeCast channel, by the way. We're going to do clips there and some extras and maybe even some live stuff over time.

We have big plans for that channel. But for the main episodes, Tuesdays and Fridays, stay tuned to the Vergeist channel. You can subscribe to the channel, you can subscribe in YouTube music, you can subscribe to the podcast playlist specifically. The world is always very easy.

I know we had some migration issues the last few days, but I think those are solved now. And if they're not, send us an email, VergeCast to the Verge.com. We'll get it fixed. Oh, and by the way, if you're like, what are you talking about?

I listen to podcasts because people listen to podcasts and I have a podcast app and I've never seen David's face and I don't want to see David's face. Totally fine. I get that all the time. Nothing should change.

Everything will be as normal. So don't worry. All right. That's enough housekeeping for now.

Let's just get into the show. We're going to do two things on today's episode. First, we're going to talk about Pasky's, which are the supposedly revolutionary technology that is going to make being online easier and simpler and more secure all at the same time. It's very cool.

Sure. And we're gonna have to ask, and I have realized. I don't understand Pasky's like at all. So we found somebody who does and we're going to figure it out together.

Then we're going to talk about wearables. And the idea that wearables are just smartwatches feels wrong to me. Like I wear an AWP watch, I love my AWP watch, but we were promised this big revolution in wearable technology. I don't think we ever really got it.

So we're going to try to figure out why. All that is coming up in just a second, but first, I have to go home and make my face and hair look better before I have to do this again. This is the VergeCast. Let's go.

Support for the show comes from audio. Running a business is hard enough. So why make it harder with a dozen different apps that don't talk to each other? Introducing Odo.

It's the only business software you'll ever need. It's an all-in-one fully integrated platform that makes your work easier. CRM, Accounting, Inventory, Commerce and more. And the best part?

Odo replaces multiple expensive platforms for a fraction of the cost. That's why over thousands of businesses have made the switch. So why not you? Try Odo for free at Odo.com.

That's ODOO.com. What's up y'all? I'm Skyler Diggins, seven-time WNBA All-Star, Olympic gold medalist and month. And I'm Cassidy Hubbard, host and reporter for nearly 20 years, covering the biggest names and stories in sports and mom.

And this is A-Mom, a community for athletes, game changers and moms of all kinds. Dropping May 14th. Happy end with us. Welcome back.

Alright, let's talk about how to have good password hygiene on the internet, which is the least interesting thing I could possibly imagine saying to begin this. But that's actually part of why I want to talk about this. I feel like I've spent most of my life scolding people to have better passwords and use a password manager and get two-factor authentication, but not SMS two-factor authentication. And it turns out most people just don't care.

And even I still use the same password across way too many services. It's a real problem, but there's this one new technology called Pasky's that in theory might be the solution to all of our problems. It's designed to be more secure than passwords and also simpler than passwords and basically just better in every imaginable way. And it's growing really fast.

Google supports Pasky's now, so there's Amazon, iOS and Android both do. You can Pasky log into TikTok and WhatsApp and Uber and PayPal and a whole bunch of other services. This tech is very much catching on in a way a lot of the supposed replacements to the password haven't in the past. But I have to confess, I don't really understand Pasky's.

I mean, I understand the theory. They use an encrypted token on your device to authenticate you rather than a password that you type into a text box. It's about all I understand about it. So I invited onto the show somebody who knows much better.

Anna Poplett's head of passwordless. At One Password. Anna has been working on passwordless tech for a long time. So I asked her to come on the show and explain to me how Pasky's work, why everyone is convinced they're the future, and most of all, how we as normal humans are supposed to use them in our lives.

One note before we get into it, she talks a bunch about One Password specifically, which makes sense. I mean, that's where she works. But a lot of what she's talking about is true for most password managers and most platforms. That's part of the point of Pasky's is that they are the same everywhere.

She also makes a point later on in the interview about the upsides of a third party cross platform password manager rather than using the ones built into your device. And I actually think that argument is pretty compelling. But again, there are a lot of good options there and you kind of can't go wrong. Anyway, let's get into it.

The first thing I asked Anna about is basically why haven't we killed passwords yet? It's been the death of password for forever. Pasky's are supposedly the end of passwords, but I've heard that so, so, so many times before. So what is it about passwords that means they just won't go away?

We've been talking about how passwords are bad for like 20, 25 years, right? Since passwords. Yes, exactly. Like over and over again.

So why now seems like a very reasonable question. And I think the truth is that this is the first time where security and user experience aren't mutually exclusive. If you think about previous attempts to either like improve the security of passwords or replace passwords, they always come at the expense of user experience. So for example, multi-factor authentication.

Add security to passwords by requiring a TOTP code or an email or something like that. But that's an extra thing that a user has to do to log in. If you think about certain types of biometrics like proprietary biometrics, that's some sort of hardware that you need to add into the mix. And so there's always this extra step or extra thing that a user has to think about.

But with Pasky's, the idea is that you don't have to compromise on those things. You're going to get better security and you'll also get a really smooth frictionless sign in process. So from a pure user experience perspective, I think it's right to say people will do the simplest thing, right? And even when we know it's bad, even when it's terrible hygiene that everybody agrees is bad, I think most people intellectually know don't use the same crappy password for every single thing.

And yet most people do because it is just the easiest thing to do. And it's very annoying to remember all of your different passwords. You know, funny way, it seems like the bar is both very low. In that you have to replace people's crummy passwords with something more secure, but also very high because actually remembering one password that is just one, two, three, four and then typing that in everywhere is actually a pretty good user experience.

Certainly a good user experience. Yes, but the bar is so low on the security side. It leads to bad things. Yeah, exactly.

So when I think about like all the things that are wrong with passwords, for me, it really comes down to the fact that passwords put all of the burden on a user to be secure, right? It's on you as a person to think up good passwords, remember them, not use the same one everywhere, not fall for a phishing attack, all of these things. But with Pasky's, the goal is we can actually remove the human error completely from logging into apps. And so if we give you something that's easy and frictionless and the security is actually built into the technology, then there's nothing for you to do wrong, right?

Like it just works. So in the case of Pasky's, when you're logging in, all it does, it looks and feels to you like you're just unlocking your device, usually something like Face ID, Touch ID, Windows Hello. And so it looks and feels like something that is familiar to you, something you know how to do and there's nothing, there's no thought you have to put into it of, did I pick my most secure Pasky, right? It's just kind of all happening behind the scenes.

That's really smart because I think so much of this stuff and we talk about this with sort of security and privacy in all forms on the internet. It all ends in scolding, right? You kind of have to make people feel bad and scare them in certain ways in order to just like beat them into having good behavior. And what it actually is is if you give people a better product that is also safer, they'll do it.

And if you make them feel bad, they still won't change their ways. And I think what this whole industry seems to be coming around to in a cool way is like, what if we just built better products? And I think that's very exciting. Yeah, totally.

Like it's not that people don't want to be secure. I think that's not where this is coming from. That's not why passwords have stayed around. It's sort of just like an inertia, like it is what people know how to do and it's there.

And there's never really been an option that feels a lot better. Like I used to do security consulting for a number of years and we would work with these companies and they would tell them like, hey, you have a weak password policy or you need to add two factor, all these controls around your account security and especially for consumer facing applications, they'd be like, I mean, I could, but that's going to hurt my user conversions. People aren't going to sign up for my application. And so that trade off was never worth it to them, right?

But with past keys, you can actually, we can say this actually can help your conversions. Users will sign up faster for your application. And so all of a sudden there's also a business reason to use past keys, not just a security reason. Yeah, where did past keys come from?

I feel like in the time I've been covering the space, there was a minute where it was like, everybody's going to have a UB key and that's the solution. And then we got into two factor in all of its many different forms. And I think we went from bad two factor over SMS to like pretty good two factor inside and off the insomniators around. And past keys kind of crept up on me a little bit over the last couple of years.

But my sense is they've been around longer than most people realize as kind of a possibility and an idea. Like where did this come from? Yeah. So there's a technology that kind of underlies past keys called WebAuthn that's been around for probably about 10 years, I think.

And there's a group called the FIDO Alliance. That's like an industry organization. A lot of big companies are a part of it and they're all focused on bringing passwordless authentication to the world. And so this protocol was invented.

It's the same thing that UB keys use that's used to provide this sort of public key cryptography based authentication. So it's been around for a really long time. You usually had to have some sort of hardware key like a UB key. And so it might work really well in a workforce or corporate environment, but could be really challenging for the everyday people who don't just have a UB key, right?

I got a UB key. I set up everything on my UB key and then I realized the place I leave my keys is several rooms away from where I sit. Right. It's on your computer.

Like my keys are upstairs right now with my UB key on them and there's no chance I'm going to use it. Exactly. Like the fact that you even have one is really rare. And so a couple of years ago, there was this big announcement from the major platform saying we're now supporting what we're calling past keys, which is essentially WebAuthn credentials that can be synced between your platform account.

So now instead of being tied to hardware, those past keys are stored in your iCloud account or your Google or your Microsoft account. And more recently, maybe your one password account, which we'll obviously get into at some point. But the idea is that now these credentials are a little bit more accessible. You don't need special hardware.

They'll sync between your different devices a little bit better to make it a little bit easier for you to access them. And that's been like the big push that you're hearing about in the last couple of years. Got it. Okay.

Was there a technical development that made that possible? Like what happened between a decade ago and maybe two years ago when this really started to become a thing that kind of tipped it into this is a thing we can do in a real mainstream way now? And that's a syncing concept. And so Apple, Google, Microsoft saying, like, yes, instead of storing these credentials in like a secure enclave on a device, we can store them securely in your cloud account and we can sync them between these different devices.

So in some really, really high assurance environments that might be a little bit of a security trade off, right? Because you don't have as much hardware security there. But for most consumer use cases, if you're logging into Home Depot or Netflix or things like that, that's actually still a really good security story. And it's way, way better than passwords.

So you're still getting all of those sort of unfishable security benefits of past keys, but with a little bit more user friendliness. Got it. Okay. So I'm going to talk about this because I think I was reading through in preparing for this a bunch of the criticisms people have of kind of all of the password replacing technology.

And there are two I want to talk about. One is now everything is on my one device. What happens if I lose my device? We'll get to that in a second because I think that's very interesting.

It also just happened to me recently. So we'll talk about that. But the other one is people saying, well, actually secure passwords are part of the problem, but the bigger problem is phishing and its people social engineering their way into my accounts. And actually what we have to solve is that problem and not people having bad passwords because if somebody can convince me to type in my password on a fake web page, we've solved nothing.

But the belief of past keys is that they actually solve most, if not all of that problem too. Right? How does that work? Yeah.

So there's a few really big security benefits with past keys. So there's kind of the obvious of like, you know, there is no user generated secret type of thing that someone could guess that they could just, you know, reuse across a bunch of websites and guess I can't leak you a password if I don't have a password. I guess it's something exactly. If I don't know what it is, you can't guess it.

So that's really big, right? There's a lot of attacks that can happen remotely and at scale that things like credential stuffing are really common against websites. So those things can all go away because there just isn't a credential in the traditional sense. Now the other big thing is, of course, resistance to phishing attacks.

So past keys are tied to a specific website or domain. And so if an attacker were to make a lookalike site, you know, Facebook.com with zeros instead of owes your past key for Facebook.com, like will not be used on Facebook, the lookalike site, right? Those passies simply aren't transferable. They're not the same thing because the key on your phone and the key on Facebook just will literally will not understand each other.

Exactly. Like that key won't be used on that site at sort of at the device level at the browser levels, like all there's a lot of protections in place to sort of tie these pass keys to a specific domain. And so at least for that specific type of phishing attack where which is really common, you have a lookalike site, they ask you for your password and then they reuse it on the right side. Real site, that just kind of totally goes away.

And I think that's really big, especially right now. There's so many news articles around like AI and how AI is making it even easier to make really realistic phishing attacks. This type of prevention of that whole swath of attacks is really, really big and just gives people a little bit more confidence. I think when using the internet that you don't have to constantly wonder, is this the real site?

Is this a real email? Do I need to double check? Like I think just giving people a little more confidence in that way is helpful. Well, and there's a weird tension in that even that it feels too easy, honestly, using pass keys sometimes, right?

It's like, this can't actually be solving my problem. All I did was tap the thing, the pop up on my phone that said, we cool and I said, yeah, we cool. And then I now I'm logged in. Like at least with the password, you kind of understand I am delivering something that is a secret in order to allow me in.

And there is something to the fact that this is so simple that it almost feels less secure, even though it's not, I don't know, part of me wants you to like make it seem scarier every time I do it because it'll make it feel more secure. This is actually a very real thing that I think I've seen that people in the Phyto Alliance have seen when you do research with end users that they're kind of like, oh, okay, I guess I logged in. Like they maybe don't even recognize that they actually registered for or logged into an application and they're like, okay, I guess I was okay. How am I going to do that next time?

Or they don't totally understand. And so there's been a ton of research done on the best ways to communicate to users what's going on, which I think is so important as websites start to roll out past keys that these are experienced. They're just so important to make sure users are like, oh, okay, like this looks and feels like my touch ID. Like I understand what I'm doing here and kind of giving them that experience, but it is really hard, which is it's silly.

Kind of silly that, you know, security has to look hard. Like people are used to security being hard for it to work. And so it's kind of breaking that stereotype. And that kind of goes to the other piece of feedback I've seen a bunch of past keys, which is that we've all been trained now that you have to have two factors, right?

There's the thing you know and the thing you have. And the thing I know is my password and the thing I have is my phone. Great. That is better than just a password.

And there's something to kind of compressing all of that back down into a past key that like I just I don't even know, right? Like tweeted or something about past keys in one password being like, this is cool. It's all I can now have all of my stuff in both apps. And I got a bunch of responses from people being like, that's not two factors, security.

That's one factor security because it all just lives inside of one password. And I was like, I don't think that's true. But I'm like, I sort of see the point right where it's now as long as I'm holding my phone, there's no other jobs to do. And I wonder if part of that is again, you're sort of obfuscating the steps in the name of simplicity that actually makes it feel like I'm not doing the hard work of being secure anymore.

Yeah, I think that's really fair. And I think we talked about these traditional authentication factors, something you know, something you have, something you are or whatever. And talking about pasties and that sense is like a little bit confusing, but I think I kind of do it anyway to help explain to people. I think the easiest way to think about it is something that you have.

It's whatever device you're currently logged on to say your Google device or your one pass or whatever your one pass or your browser extension or your desktop app. And then it's also something you either have or are or know or something like that depending on either your touch ID, your pin, your one password password and secret key, it can be like whatever that other factor is that you're actually using to log into the account where your past key is stored. But there's always a little bit of a like device ownership aspect to that, which kind of gives you that second factor. And so it's a little bit like square peg round hole, but I think you can kind of roughly put past keys into that bucket to help people feel a little bit better about that.

Okay. Yeah. So the two factors then if you were to sort of pull it all the way down to basically be my phone and the information required to log into my phone, which is two things. And I think ironically back to that, like this is almost too easy thing.

I think if you were forced to type in your past code every time, it would make more sense. Whereas with the face ID or the Windows Hello, it kind of, it almost happened so fast that you lose track of it. And it's like, well, I didn't have to authenticate anything. I was like, no, you did it.

It just happened really quickly and automatically, which is a great thing, but kind of an alarming one to get used to at first. Like I certainly took me a few tries to realize, oh, it's doing face ID every single time my past key comes up because that's part of the authentication process. Exactly. I don't think people think about that when they're just unlocking their phone to use it.

Like they don't necessarily think too hard about it. It just become sort of second nature. But maybe it was like that at the beginning and I was like, oh my gosh, my password, my phone's not locked. You almost don't notice because you're so used to using your face ID or your touch ID for all sorts of things, right?

Like a lot of apps use that technology just to unlock an app. And so the idea is we are using the thing that's familiar to people. It's just getting people comfortable with that technology in a new context, like a website or an app. What do you make of the idea of tying a lot of this stuff to a device?

I think on the one hand, phones are sort of inextricable parts of us at this point. Like my phone's right here and my UB key is upstairs. Like that is a telling fact, right? But at the same time, I had this moment the other week where I woke up one morning and my phone had updated overnight and was bricked.

The touchscreen didn't work. I couldn't do anything. I'm like, oh, I can't do two factors because I can't get SMSs. I can't see them anymore.

I can't get into my one password account because it's just sitting here on my phone. I can't text my wife. And I had this crazy moment being like, oh, I am way too reliant on my phone to work and have a charge and be sitting here nearby me all the time. And otherwise, my life kind of falls apart.

And I think there is a reflexive worry that people have about that, that it's like the nice thing about having a bunch of insecure passwords stored in my head is the battery doesn't die. Yeah, they're always there. Right. And so like is it the right path to go down, you think, to tie it to these devices in that way?

I think it's better to think about it less as tying it to a device and more of tying it to your platform account. So if you're an Apple user, primarily, you know, you have an iPhone and a MacBook and all that, you probably use your iCloud account to store your contacts and to store a lot of stuff. And so when you get a new phone, for example, you log into iCloud and like you recover all of your data in that way, right? And so I think thinking about it that way is a little bit more realistic to be honest, I've sort of the current state of past keys where it's challenging.

It's the same way, like you lose your phone. It's really annoying to recover all that data, but past keys will get recovered. If you think back to like the old WebAuth end days, your past keys were like impossible to recover in that situation. And so that's one of the big problems you were trying to solve is to make account recovery a little bit more possible.

I think that's also a really big benefit to using something like OnePassword. So I use a MacBook laptop, but I have an Android phone. And so I have this like cross platform situation in my life that isn't really ideal for Pasky to be honest because of Pasky on my Android phone doesn't really naturally translate to my MacBook. It's this really kind of weird QR code experience.

But instead I use OnePassword for everything. Okay. And then the idea is that then because OnePassword works across platforms, my Paskys live in my OnePass account. They don't live on my laptop.

They live in OnePass account. As long as I can get into my OnePass account, which ironically soon you might do through a Pasky, which we should talk about, then I kind of have it wherever. I am. Exactly.

That structure makes sense to me because then you're on as long as you can log into something, which I think in the year 2024 is a pretty reasonable assumption to make. But that brings me to the question of logging into all of my Paskys with the Pasky. And I just think part of what's really interesting about that is like OnePassword is very much starting to try to own the whole security stack. I now have two factor codes in my OnePass word.

I have my Paskys in my OnePass word. And I would think that raises the stakes pretty dramatically for OnePass word. Now if something bad happens to my OnePass word stuff, not only is someone going to get a control of my password, they're going to get control of everything. And one piece of security advice that I've heard from people over and over and over is don't store everything in one place because you should assume everything is insecure and essentially don't let the two sides of the coin talk to each other.

And you're kind of saying the opposite, which is like put everything in this one place because it's simpler and better. And I certainly agree that it's simpler, but does it change the way you have to think about even the security of OnePass word itself? That's a really interesting question. I actually don't think it does because our whole thing from the beginning has been that we take your security and privacy really seriously.

Everything is end-to-end encrypted. OnePass word has no access to anyone's actual credentials. And I don't necessarily see a password as being any different from a pass key from the OnePass word perspective. It's ultimately just a credential material of some sort that we're storing and we're going to protect the same way that we would credit card data or social security numbers or whatever data you want to store with us.

I try my best instead of saying password manager to say credential manager or something along those lines because it is so much more than passwords and has been for a really long time. And so I don't think it changes our security model that much. We're always looking to upgrade that and what can we do to improve, which is where obviously using a pass key to sign into OnePass word comes in. Right now we have that password and secret key sort of model.

We have SSO support if you're a business customer, but for the most part it's kind of that two factor. The secret key is a device key. And so we're always looking for ways to upgrade that, which is why we've been exploring Passkey login, which would be really incredible to add to OnePass word. Yeah, why does that feel like the right way to do the sort of master login?

I think part of what I'm getting out here is I think what we're boiling down to is there being one sort of crucial login, right? Whether it's the passcode on my phone or my master password for OnePass word, like there's going to be one thing I have to know and that is the thing that opens up everything else. And I think with phones, one reason people are nervous is like the Wall Street Journal did a bunch of really good reporting about people having their phones stolen and their passcodes read. And that becomes even scarier in this world where my pass keys also live on my phone because now all you need to know is the four digits I used to log into my phone and you can have everything.

And we have something like OnePass word now. It's like I don't I literally don't know any of my passwords except my OnePass word anymore, which I think in a lot of ways is the intended behavior. And that makes sense to me. I don't reuse that password anywhere.

I don't even have that password written down anywhere. It's just it's the one password I've memorized. But now you're trying to even replace that. Why?

Yeah. And one password stays in particular. So I'll speak really just about that. But you have this password and you have this secret key.

And so even in just the state of the world right now with one password, if someone were to get your master password, that really long one, the one that you have to remember, they actually still can't get into your own password account unless they also steal a device that you have one password on already, which is really great. Right? That's a good starting point. But now what if we also make it even harder for someone to steal that password because it's not a password, right?

It's not even something you know. Now, yes, that pesky does have to then live somewhere, right? So it has to live in your platform account or in a UB key or something along those lines. So there is kind of this like vicious cycle of where does the final passkey live.

And I don't know if that's like a perfectly solved problem right now, but still a way better experience than right now. So we're working through it. Yeah, I agree with that. I mean, it is just really interesting.

I think you're exactly right that at some point there is the one thing and the question of what the one thing should be. I don't know that we know yet. I don't know that we've answered it. And I think the idea of it being a hardware thing that lives on my key ring makes a lot of sense, but has downsides.

There's like the perfect version of it would be like it lives in a safe somewhere far away where no one can get to it. But that obviously is a disastrous user experience. But also somehow you can get to it. Exactly.

Yeah, I do have any sense of what the best available version of that is. Is it your phone at the moment, like the device you have? Yeah, I think the current state of that is, you know, we recommend that your passkey for one password lives in whatever your platform account is, or you be key, right? And your iCloud or Google, we typically recommend that you have a backup because obviously if you lose it, it's just kind of a pain to be honest to recover.

If you kind of lose that master one, so we recommend you have some backups. So it's kind of the state of the world right now. I think in an ideal world, it's something much more about your real life identity, like your human identity that can identify you to a computer, right? And like none of that stuff is real.

Yeah. And so exciting things that people think about in the future and are working on of ways to kind of like tie those things together, but in a way that also still is like privacy preserving in some way, right? It still protects your identity online, but it makes a stronger sense of who you actually are on the internet. And how broad can pass keys be in that sense?

I mean, you mentioned wanting to log people in quicker and making the case that they're more like the complete transactions that way, right? I just think about the number of carts I have left un-purchased because typing in my address and credit card number is really annoying. Like, much less setting up an account, even the like guest flow is a giant pain. Can pass keys be a store of information beyond passwords in that sense?

Is that even a thing people are thinking about? It definitely is. It's not really inherent in pass keys themselves, but there's a lot of sort of like additional like wallet type of technology or other types of technology that people are talking about and working on that is kind of like that where it's more about other information that's being stored. It's almost like that password manager experience where you can store your address and your credit card information to auto fill because no one likes that.

I don't want to make an account. I want to be able to check out as a guest, but I don't want to type all that information. So there is a lot of work to be done on like doing that in a more like cryptographic secure way like pass keys, but the technology doesn't exist today. It doesn't really support that just yet.

It's really exciting though. It is really exciting. It's kind of thing if it goes from I have to type in all of this information about me on the internet over and over ad nauseam to I have a secure version of all the relevant information about me and I can just dole it out in secure ways whenever I need it. That's just a better internet.

That's how this should all work. That's the dream. Yes. And it doesn't seem like increasingly the companies who are storing things like my home address and my credit card information and my password don't want that anymore because it's a security risk.

Like I can't imagine if I'm best by your home depot. I want any of the risk that comes with that anymore. So I would think both of these businesses would be psyched to figure out how to make this stuff work, right? Yeah.

I think that's the same way that companies would want to get rid of passwords or any really like I either storing, right? If they can offload any of that risk and not have a giant database table full of something that people are looking for, you know, I think that's obviously a win, right? And so I think Pascades solve that security benefit, the sort of compliance regulations around like there's a lot of good reasons. And I think it's the companies who are excited to make a user and security improvement, like those are the companies that I'm seeing like most excited about Pascades.

So if you fast forward, I don't know, two, five, 10 years, however long it takes for Pascades to become like truly mainstream. Is there any case left for either having a password that I type into a website or the flip side or having like the log in with Google, log in with Apple stuff? Like as Pascades get really good, does everything else disappear or do those things kind of have their place to? Yeah, I think passwords are never really going to fully go away, but I would hope that maybe like 90% of passwords can go away, especially for the types of apps that we as people just like use every day, right?

Our banks, our Netflix, our online shopping, like those types of things, I think are kind of perfect use cases for Pascades. I think there's a lot of good uses for more like social login, like a login with Google or something like that, because maybe they need access to your email, you're sharing other types of information that you get from having that connection, and then there'll probably always be some apps that just use passwords and maybe it's a password and a passkey as a second factor of authentication or something like that, but I would hope that for most of the things you're using every day, we could get to a point where passkeys are working for those types of apps. All right, we got to take a break and then we're going to talk about variables. We'll be right back.

I'm Maria Sharapova and I'm hosting a new podcast called Pretty Tuff. Every week I'm sitting down with Trailblazing Women at the top of their game to discuss ambition, work ethic, and the ups and downs that come on the path to achieving greatness. We'll dive into their stories and get valuable insights from top executives, actors, entrepreneurs, and other individuals who have inspired me so much in my own journey. Follow Pretty Tuff wherever you get your podcasts.

So we are 250 years into this American experiment and I'm saying it's going okay, I give us like a C plus. There is no perfect past, but there is also no exclusively negative past because humans are going to human, that's what we do. I think the story of America is the struggle of people who have not been included in the promise of America to expand those principles to include more people. What's going to determine the next 250 years of America and how do we write a new social contract that can give us the democracy we deserve?

Okay, so I'm just going to be a jerk here because I'm a historian, so we have to have a prologue explaining, you know, we the people. Okay, you know, I just don't remember from Schoolhouse Rock. We the people that go into the former for a future that established justice. What is it?

Ensured domestic tranquility? So you're talking about a foundational document, so I'm building a document that will protect American democracy. That's this week on America, actually. This week on Network In Shell, I'm joined by tanks and after the meme king with over 50 million followers across tank good news, influencers in the wild, and his personal account.

Tank is breaking down what the meme economy really is, how much a single sponsored post pays, my major brands are throwing serious money at jokes and how meme culture think preparation age starter packs and a perfectly timed screenshot is actually reshaping how we think about money and value yet ready for a conversation that'll change the way you scroll, make you rethink what's going viral is really worth and prove that sometimes the most serious money moves are wrapped in the silliest of jokes. Listen, wherever you get your podcasts or watch on YouTube.com slash your rich BFF. Welcome back. Over the last couple of years, it feels like the wearable industry has boomed.

You have the Apple Watch and the Pixel Watch and the Galaxy Watch all getting pretty popular and pretty good, but it also feels like the wearable industry has kind of died. I don't know, it just feels like a few years ago, there was all this energy to bring tech to our bodies and give us stuff to hold and wear and clip on that would do all kinds of computery things on our bodies in simpler ways. And now there's just smartwatches and they're basically all just health devices. And that's just what there is now.

So is this just the way it goes from now on? Is this what the wearables industry has become and will be forever? Tell me figure out, I grabbed Vsauce who is the virgis wearables reviewer and the person wearing the most gadgets at any given time that I have ever met in my entire life. Vsauce, welcome back.

Hi. How many wearables do you have on you right now? Four. What are they?

Are you allowed to talk about all four of them? I have a watch ultra two, the ordering gen three and the EV ring. Two smartwatches, two smartwatches. Pure redundancy.

So many things counting your step and giving you dubious information about your stuff. Yeah, yeah, it's what we like to call a control device. I actually use that ordering to test all sleep tracking just because they're like, oh, we're a sleep tracker, they're pretty accurate for a certain metrics. So I have that and my bed also tracks sleeping.

So there's just a lot of control devices to control for accuracy. So do you wake up in the morning and get like six different scores on how you slept? Yes, I do. That sounds awful.

One score stresses me out. I have six different scores and then while I'm brushing my teeth, I compare all of them. I go, you're not accurate or that sort of stuff. So yeah, that's the behind the scenes of wearable testing.

That's good stuff. I give up on sleep tracking like the third day that I woke up feeling like crap and it was like congratulations on hitting your sleep goal. It's like, I don't know if I did or didn't screw you. To be fair, like a lot of sleep tracking is kind of dubious in terms of accuracy.

It's not, you know, when you usually take a grain of salt, take two with sleep tracking. So that's just how it is. Yeah. Okay.

But I want to talk about like the state of wearables because I feel like there's been a bunch of news about wearables in the last few weeks. There was a bunch of stuff at CES. We're in kind of a weird place right now. And I have a bunch of theories about this, but let's start with fossil because I feel like fossil as a company was trying to do something different and interesting and had a really sort of cool idea about what smartwatches could be.

So you know, it's really sad that fossil is now a fossil with them. But like, well, that's the first cast of everybody. I should make that joke in the actual headlines. So I had to do it elsewhere because everyone else was making that joke at me.

But so fossil basically kept wear a wess afloat, like almost by itself, because fossil is not just fossil, it's diesel, it's skoggin, it's all these other sub brands. And for the longest time, if you bought a wear a wess watch, it was a fossil. So they kind of kept Google going through all of that time. And so for them to actually just like call it quits to completely exit the smartwatch industry, that's really big.

It's kind of just wow. It says a lot about where smartwatches are at this point in time in that it's like, you know, there used to be this notion that Apple was its close garden and Apple was the main smartwatch of choice for iOS users. But it's sort of happening in the Wear West space now too for Android because it used to be that Android was the wild west of smartwatches, kind of like phones. But now it's Google and Samsung also kind of like phones.

So that's just kind of where we are and fossil leaving. It kind of cements that. And I'm actually pretty sad about it. I am too, because it seems like, I don't realize now how long ago this was.

But if you go back to like 2017, maybe 2016, 17, there was this idea that all watches or at least many watches of many different styles, many different price points, whatever, we're going to become some kind of smart, right? There was going to be this whole interesting spectrum where I remember I went to, I think it's called Baselworld, it's like very fancy watch show and it was like the year everybody was into smartwatches. So I was at Wired at the time and I'm sitting down with all these people as they're explaining like the beautiful history behind this $12,000 watch and then they'd be like, and also Bluetooth Wired. But I liked that idea and it was like, we think it was doing cool stuff like that, this kind of like hybrid smartwatch idea where it looks like a watch, it looks like a piece of your light, but also still had some tech in it.

And it feels like everything on that spectrum that isn't an Apple watch or something that looks like an Apple watch is just gone. Like we've just given up on that idea almost entirely. It is really weird because for right now, in the last couple of years, actually smart watches have just like slowly consumed everything. Like where has the budget fitness tracker gone?

China. That's it. Like that's where most of them are at the moment. And it used to be that Fitbit had its own Fitbit was the word that everyone used.

Even though it was a brand that used it to mean fitness tracker. It was cleanex, like in a really real way it was cleanex. Very sudden later in CES, I woke up and was like, are you kidding me? I'm at CES, please.

Are you kidding me right now? But yeah. So that's kind of where Fitbit is. And it is really just the Apple watch, the Galaxy watch, with a pixel watch at this moment in time, and that's really sad.

But to your point, fossil really embodied that idea of we're gonna have so many different smart watches and so many different form factors and so many different styles. Like Kate Spade watch, there was the... They bought Misfit for a while in Israel. Right?

They had so many cool ideas. They did, and like the touch bezel, the Samsung basically managed to actually execute and all that stuff. But there used to be a joke I would tell my editors. I was like, it's a trade show.

I'm gonna go to fossil, but, and I did this at Gizmodo a few times, I was like, I'm not gonna cover every single watch that they released because there's gonna be 20 of them. I'm just gonna take a picture and say, look at all the fuckin' smartwatches that fossil has brought. And they would come to each trade show with I wanna say like 20 to 30 different watches. And I'd be in a room and I'd be like, okay, what's new about this watch?

This watch, is that watch? But our money. This watch, is that watch? But diesel.

And you know, that kinda gets to the problem of the fossil watches as well. But, so. Diagnose that for me, because I think you could make the case that that is actually like an awesome outcome, right? Like, nobody's mad that there are lots of different brands of t-shirts that are all t-shirts.

Like, that's how it should work. It's fashion that lets you make choices. And we were in this moment where technology was just gonna be sort of integrated into that. And I liked the idea of having a watch that seemed like a watch, but would also buzz when I got a phone call and count my steps.

Like, that to me was almost everything I wanted from a smartwatch. And that has died. And what I can't tell is, which of the many things that went wrong are the real problem. Like, I think there's a thing where Google neglected Wear OS for a really long time, and sort of hung fossil in a bunch of other companies out to dry.

There's a thing where maybe people just didn't want to watch the picture and think, I don't know, what's your read of like, why that all fell apart? It's a lot of those things in small increments. So it is like a fact that fossil invested so much into the Google system. And then, you know, a couple years back, Google took about $40 million worth of fossil R&D and brought it over into Google.

So that was kind of one of the first big signals that Google was gonna start taking wearable seriously again. But you know, it kind of got into fossil a little bit. And then another problem with fossil was that the price for the price that you were getting their watches, you got a software that was kind of not so great. It was very like jittery things would work and then they wouldn't.

And more often they wouldn't. The battery life was, ehh. So you were just getting a better experience on other smart watches, but paying a similar price. So what you really were paying for was the style and the fashion and the fact that it didn't look, you know, like this giant slab of phone on your wrist, right?

You were paying for a watch that looked like a watch. And then I think another aspect of it is that the people who are gonna go for something like Whittings and the hybrids is that they are people who are not gonna be buying on an upgrade cycle very frequently. You don't buy a nice watch intending to replace it in two years. Exactly.

And the battery lasts a long time, like this has been lasting for, I wanna say, two weeks. I don't like it. Like I haven't charged it. And that is what a lot of people want, but those people aren't the ones going out buying and upgrading every single year.

So that's not making the company a lot of money. So it's one of those paradoxes where planned obsolescence is a shittier product, but it makes the company a lot more money. So that's kind of the conflict that you have there. And I just think the other issue with Wear OS 3 and that transition is that Google clearly put Samsung first because everything comes to a Samsung watch first.

And then it'll come to Google. And then everybody who isn't Samsung or Google kind of gets a short end of the stick. Mobvoi was the other really well-known Wear OS watch alternative. And they didn't get Wear OS 3 upgrade until, I wanna say December, like this past December.

It was the thing where Mobvoi users were like, hey, you told us that if we were gonna buy this particular tick watch with a 4,100 chip, we were going to get Wear OS 3. And basically they waited until December. That's when the rollout happened. And Wear OS 4 is already here.

So now they're just like a generation behind. They're barely catching up. And they don't even have Google Assistant on their wrist. And Fossil did have Google Assistant, but they also had to wait a really long time to get that rollout out.

So I can understand where from Fossil's perspective, they were just like, okay, we didn't even know Wear OS 3 was happening until you announced it. What the hell? So I had to send something was not kosher, because Fossil had a very, very regular update cadence, and they missed it. Like 2023 was when the gen seven, if it was gonna come out was gonna come out, nothing.

I mean- I knew they were the one company you could rely on to keep caring about this for a long time. Every single year. So CES is up and down with Wearables, but every single year, I would reach out to Fossil and be like, hey guys, what you got going? And they're like, hey, here's what we got going.

And this year I reached out and they're like, we're not gonna be at CES. And I was like, excuse me, hold up. So many just alarm bells were going off. And I think I reached out to that end of November, early December and we were talking for a while.

And it wasn't until after CES, even that they got back to me and they're like, hey, we out. So. Yeah. So that makes me sad.

I have to say. And the other part that makes me sad is I think we skipped past the fitness band thing way too quickly. This is a thing you and I have talked about before. And I still believe this very strongly, that the original jawbone up was a perfect gadget and there should be more of them.

And I don't wanna watch, but I want something on my wrist that tracks basic things. What it seems to be is that instead of bands, rings are gonna be that thing. Like it seems like the big bet now is that if we're gonna do a non-screen, long lasting, simple kind of wearable, everybody seems to think rings are the thing. I mean, rings are big this year at CES.

There were more rings than I could count. I'd be like, do, do, do, I've seen all the rings. And then I turn and be like, nope, there's more rings. And like from names that I had never heard of before.

So I was like, oh. It's just because Aura worked. Like Aura's been in this for a few years. The product seems to do really well.

I feel like the viral marketing for Aura is very good. Cause you watch a podcast, you see somebody on TV and it's like a tech CEO and a vest. And there's like a one in two chance they have an Aura ring on. And it's not just the tech people.

It's the celebrities, Jennifer. And it's like an Aura ring. A bunch of sports stars have it. There was a period of time where I think Kim Kardashian and Gwyneth Paltrow maybe were having a sleep competition with their auras and these people have millions of followers on Instagram and they were just like, ha ha, beach you.

In my Instagram story. So Aura really had this like Prince Harry has, has an Aura ring. So they have a lot of buzz in that respect, but they weren't the only smart ring around. They just kind of R.I.P.

motive. That was a smart ring. Yeah. There was a motive and a motive ring too.

And they just kind of like killed them. So to speak. And it was actually really quiet in the smart ring space for several years. And that's because smart rings compared to fitness bands have a lot of technological challenges because they're so small.

They're just so entirely small. But I think we're starting to figure that out. And then there are some health advantages to a smart ring compared to a fitness band that really make them good for sleep tracking. And part of that is just literally where it's placed on your body.

Yeah. So actually your wrist is terrible for most metrics. I just learned this recently that they're like, oh, let's put all this stuff on your wrist. Even the wrist is the worst.

Yeah. So like the way these sensors work is that they're shining light into your skin and it's reflecting off of your blood. And so that's how they reach a heart rate. It's a proxy for your both blood.

Yeah, yeah, I've written about it a ton just read myself. But the problem is that you have so many tendons. There's so much movement in your wrist that there's so much signal to noise that it's very difficult to get an accurate read, which is why if you have a wrist-based wearable and you're like, hmm, this sounds wrong. That plays into it.

But the underside of your finger is a lot more ideal. There's a lot less noise. The skin on your palm, no matter what, no matter how much melanin you have, the skin on your palm is a lot lighter. So it kind of removes your skin color a little bit as a barrier to accuracy.

So there's just a lot of reasons. It's a lot more comfortable aware. You wear rings anyway. So when you're going to bed, you're not.

I have had a lot of watches that are gigantic from Carmen. So you know, in the middle of the night, I'll like up and I'll rip it off because it's uncomfortable. So sleep tracking has gotten a lot of popularity in the last few years. This is the ideal form factor for it.

So that's kind of why. I agree with that. I will say the thing that I've had trouble with with rings and the aura in particular is one that I would say like every three months, I'm like, I'm going to become an aura person again. And I pulled the one out of my drawer.

I charge it. I put it on. I like it for the step tracking. I like it because the battery doesn't die all the time.

I'm like forever being driven crazy because my Apple Watch battery seems to always be dying. No matter what is happening, it's always dying. And the aura ring is like a sort of light tracker in a way that I really like. I cannot type with that thing on comfortably.

I think it's probably just that I'm not used to it yet in the same way that when I started wearing a wedding ring, it took me a while to get used to it. Now I don't even notice it on my finger. But it's a pretty chunky thing. And it bangs around on the palm rest of my computer.

I grant that I'm not used to wearing chunky rings and lots of people are used to wearing chunky rings. But it was harder for me to get used to having on my body than I expected it to be, actually. Well, yeah, if you're in fashion, you definitely have a statement, right? This is not statement.

It's a real ring size, but it is chunky. I have several rings on my finger right now. And the normal not smart rings are much thinner. It actually kind of looks funny.

I guess it's like a smart ring. You're wearing four rings and two of them look like grass knuckles. Yeah, that's basically what it is. And a lot of that is the tech.

There's just a miracle that they can make it this small. It's actually a miracle that this particular version of the war ring is completely round. That was a huge engineering challenge. I had a little tire for a long time.

Yeah, the flat tire is where they put the battery, because when you have a flexible battery, it's very difficult to make it round. So there's just all these technical challenges that come with smart rings that make them big. Because I'm like, this is pretty good. If you think about what a smart ring is, and I always get our readers and some people in my DMs, just like, I'm not getting it until it's as thin as a regular ring.

So okay, you'll be waiting for a while. You'll be waiting for a very long time. So but then in that case, I understand why these things would exist, right? Like the size of auras market makes sense to me.

There are people who want the things that are not. What I can't figure out is why somebody like Samsung would make this. Because especially the thing we've learned over the last bunch of years is that, like A, you're right, ecosystem is important. But B, the market even for a smartwatch is significantly smaller than the market for a smartphone, at least right now.

And then to take away all the computer stuff, even on a smartwatch and say, okay, this thing is just basically a lightweight tracker. It just feels like that just seems like a thing that cannot possibly apply to as many people as a company like Samsung is trying to reach. But maybe I'm underestimating how many people want that thing. So what I will say, and I think a lot of our readers who have or rings will kind of back me up is that it's not a good primary tracker.

It's a very good secondary tracker. But having a very good secondary tracker necessitates that you have a primary tracker. But you've already like, we're way down the funnel of people who care about this stuff at the point. But it is a thing where it's like, if I care about sleep tracking, which an increasing number of people do, and especially if you're an athlete and you care about recovery tracking, like this is a very small sub-sector of people, but it is a very passionate sub-sector of people.

Then a ring that is something that you can have on all the time is not held to the same battery constraints as a smartwatch, then it kind of becomes like a nice secondary. And I know I'm crazy because I have four wearables on right now. I think you're the average user. Yeah, yeah, yeah.

I'm totally the average user. But basically, I will say that I definitely am like, oh yeah, if I have an or a ring, I have an Apple watch that is the perfect health tracking kind of combo. But you have to care about health tracking, which I think the thing that makes wearables, that this sub-sector of wearable is the hardest, is that fitness and health is a very, very hard habit to develop. Well, and this is kind of where I've landed as smartwatches, right?

It's definitely true that the most useful thing the Apple watch does for the most people is the health and fitness stuff. I totally buy that. I still think that's only one slice of the pie of like reasons to buy an Apple watch, and there are lots of them. And Brad and I think Apple used to think that like, get notifications on your wrist, slice was the biggest.

It's not. The health and fitness one is clearly the biggest. But it's still, I'm making up numbers, but like that's 40% of the thing. That leaves 50 other things that comprise the other 60%.

And as we get to these other things, we're just pulling all of that away. And so what I keep trying to figure out is like, is Samsung gonna try and figure out how to put like a microphone and speaker into the galaxy ring too, so that I can talk to my assistant through it? Or are we just gonna get to the point where this stuff matters enough to enough people that it's a real business? I think it's gonna be probably the latter, just because my family's full of doctors, my grandpa was like Mr.

Doctor in our family. He was the most esteemed one, and he would always tell us that your health is the most valuable thing you have. If you don't have health, your life kind of is, it's not what it could be. It's one of those things that I think the longer that we live, the more technology advances, the more that we know about our health.

Like I think that's going to kind of impress upon people that I wanna live longer. I wanna see my kids, I wanna be able to do things with them. That's gonna become more important to people. And the thing that really signed me is that is that health is not built in spurts, it's not in New Year's resolutions, it's in tiny things that you do every day.

And that's very, very, very difficult for most people to make that behavioral change. It's the number one thing that I think stands in the way of wearable adoption and battery life. Those two things, so it's just, I really think the health aspect is big there, but I don't think that Samsung would be smart to put microphones into the galaxy ring. I really don't, I think the smartest thing it could do is to bundle it with the Galaxy watch.

So that you're not buying it separately, you're buying it for a discounted price, and then you have the whole picture of the Samsung health experience, and then you're just in that ecosystem. I really think it's an ecosystem play where you get an accessory for your accessory to your phone. And I think if they're smart, they'll do it that way, where you're just like, oh, are you gonna upgrade to the Samsung Galaxy 7? Free Galaxy Ring free.

And then you do that at first, and then people get on different upgrade cycles, and then they buy in, and that's my insidious capitalism plan for better. It does kind of make sense. And it also gets you to the point where now you're literally wearing something from that company 24 hours a day. And I think it should be really scary for, or unprompted sent me a statement when the Galaxy Ring was on their life.

Oh, it's not every time. They're like, they're like, they're like, oh, this is fun. We said, we're not scared. We have hundreds of patents.

We are the leader. This is validation. And this is like, yes, but also you should be scared because you charge a $6 monthly subscription on top of a $300 ring. Samsung can go, oh, we don't need a subscription for you.

Right. Yeah, here has some rings. Here you go. Have it with our watch that also doesn't come with rings.

We've also spent two years beefing up our sleep tracking like features. So yeah, yeah. So I think, I don't think they have to worry now, but they should be a little concerned is what I think. Yeah, that seems right.

That has a lot of the vibes of like when Slack took out that full page ad when Microsoft Teams came out and being like, everything's fine. We think our product is terrific. And that went super great for Slack. Last thing, then we got to go, should I just give up on my idea and dream of the like wearable computer as a thing?

Like ever since the beginning of the Apple Watch, I have loved the thesis of the Apple Watch originally, which was basically like, we want to build a new simpler, lower touch, more personal device for you to use instead of pulling out your phone all the time. And I think like, if I were to get real galaxy brand about all of this, right? It's like, you come back to all this AI stuff that's happening and the stuff we're doing with voice and with transcription. And you can get to the point where like, okay, maybe actually talking to my wrist is going to quickly become a thing I can do and it will be good.

All of these products are running away from that stuff and toward health and fitness. And so one of two things is either going to happen. It's either going to come back around or it's just, these are just going to be health and fitness devices and we're either going to have to invent something new or the phone is going to continue to be the computer. Which one do you think it is?

I think in the short term, the latter, but in the long term, the former. So you think we might come back around? I think we are going to come back around and you can see it with AR classes. They are really, I just don't necessarily think it's going to be a risk.

I think it's going to be your eyes. That's yeah. So like it's just. It's just right in that a glasses are like, that's pretty wild.

It's like, oh, I kind of get it now. Yeah, yeah, I get it. Yeah. Once they figure out how to do actual AR and not mixed reality, that's going to be a lot.

But the thing is, is according to you, we're something on your body that's health. That requires the FDA to get involved. Like we've been talking about some more contexts for a long time. There's various prototypes in that.

But when you are shining light into your eye that way, that's a, are you going to burn your retina? That's a whole thing. We don't know. We don't know.