Tag Archives: authentication

My Fake Book…and My Real One

Inspired by Alan Beck’s Facebook post.

Alan Beck on Facebook.

This book about how to pretend you’re an A.I expert on social media is a GAME CHANGER 🔥

Chapter 3, page 47: steal other people’s posts that are going viral and post them as your own.

Why didn’t I think of that?

But if you haven’t already figured it out, Alan’s book in the last picture—and my book in the next picture—are fake.

Me, in a comment on Alan Beck’s Facebook post. Google Gemini.

Although perhaps I could slop the book. Here’s the introduction; Google Gemini just has to write the rest.

Google Gemini’s Introduction to the book Buy Anything You See on the Internet Using AI

In today’s endless digital marketplace, the challenge is rarely finding something to buy—it is finding the exact thing you want amidst an ocean of results. Whether you spot a sleek pair of sneakers in a passing crowd, a unique piece of vintage furniture in a background photo, or an unnamed kitchen gadget featured in a short video clip, traditional search engines often fail us. Keying in descriptive keywords like “blue patterned tie” or “retro desk lamp” usually yields thousands of irrelevant listings, leaving shoppers feeling frustrated. Artificial intelligence changes this equation entirely, turning any image, screenshot, or vague idea into an instant, actionable doorway to purchasing.

This book serves as your complete blueprint for mastering AI-driven shopping tools to locate and buy virtually anything you encounter online or in the physical world. By leveraging multimodal AI models, visual recognition engines, and smart browser extensions, you can bypass traditional keyword search limitations altogether. You will learn how to feed real-world visual input into AI systems, extract hidden metadata, track down obscure suppliers, compare prices dynamically across global storefronts, and verify product authenticity before committing your hard-earned money.

Navigating this new era of commerce requires more than just knowing which apps to download; it demands a strategic understanding of how AI interprets visuals, text, and seller reputations. As automated agents and smart shopping assistants become more integrated into our daily browsing habits, the boundary between seeing an item and owning it has virtually disappeared. By the time you finish this guide, you will possess the practical skills and confidence needed to turn any visual discovery on the internet into a seamless, successful purchase.

Chapter Outline

  1. Chapter 1: The Death of the Keyword – Understanding how visual AI and multimodal models are replacing traditional search engines in e-commerce.
  2. Chapter 2: Master of the Snap – How to take, crop, and optimize photos and screenshots for maximum AI visual recognition accuracy.
  3. Chapter 3: Decoding the Unseen – Using AI vision tools to identify brand names, materials, and design details from obscure or low-resolution images.
  4. Chapter 4: The Global Sourcing Engine – Reverse-image searching and prompt engineering techniques to find original manufacturers, wholesale suppliers, and direct distributors.
  5. Chapter 5: Smart Bargain Hunting – Automating price comparisons, tracking dynamic discount codes, and setting up intelligent price-drop alerts.
  6. Chapter 6: Dodging Scams & Knockoffs – Leveraging AI to analyze seller trustworthiness, verify product reviews, and spot counterfiet listings.
  7. Chapter 7: The Future of Autonomous Shopping – How AI agents will soon handle product selection, negotiation, and automated checkout on your behalf.

John again, plugging a REAL book

Once I saw the first words of the introduction, I groaned. Endless digital marketplace?

But if you have an interest in the factors of identity verification and authentication, I know of a real book you can buy….my book.

Proving Humanity: The Six Factors of Identity Verification and Authentication.

Why are identity verification and authentication important? How do you perform identity verification and authentication?

Drawing on over 30 years of expertise in biometrics and identity technology, I go beyond the traditional three-factor and five-factor models to explore a comprehensive six-factor framework. From the vulnerability of passwords to the innovative science of DNA and behavioral biometrics, this book provides a deep dive into how we prove who we are—and how fraudsters try to stop us.

Here are the contents of the real book:

  • Preface
  • Introduction
  • The First Factor: Something You Know
  • The Second Factor: Sonething You Have
  • The Third Factor: Something You Are
  • The Fourth Factor: Something You Do
  • The Fifth Factor: Somewhere You Are
  • The Sixth Factor: Somewhat You Why
  • Multi-Factor Authentication
  • Conclusion

Interested? Click the image below.

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket. Click on the image to purchase.
Purchase “Proving Humanity: The Six Factors of Identity Verification and Authentication” by clicking above.

Continuous Monitoring for Analysis: It’s Not Just for Identity and Biometrics

Multiple incidents, including the substitution of underage gig workers for qualified ones, have made it clear that “one and done” identity authentication risks fraud. The preferred method is continuous authentication to confirm that the originally authenticated person is still there.

As Bredemarket well knows, continuous monitoring applies beyond biometrics, and also applies to my analysis work for clients.

Date of last update

I often use Microsoft Excel in my analysis work, and my common practice (tip 1 here) is to insert a “date of last update” at the end of every row.

Why?

“Let’s say that you perform a ton of research and store it all in an Excel workbook. A few months later, someone questions you on a particular row of data.

“‘”John, you said that Agent Eikos didn’t support voice, but I just saw a press release from Anaheim Biometrics that talked about Agent Eikos’ new voice capabilities. When did you obtain your data?’

“Helpful hint: ‘Um, I dunno’ is not an acceptable answer.

“For years (even dating to my time at MorphoTrak and IDEMIA), I have ALWAYS included a “Date of Last Update” column in my Excel workbooks. It helps you know how old a particular piece (row) of data is. And it allows you to quickly select the rows with older dates so that you can revisit and update the data.”

Continuous monitoring

Let me give you a (heavily redacted) example. One of my analysis projects for a client involves a novel use of a current technology, and part of my work is to monitor others pursuing that same novel use.

So I may capture a data point that indicates that Red Widget Company conducted a pilot of the novel application in Belgium in 2024.

What does that tell me? Next to nothing.

When I see an Excel row with a 2024 date, I really wanna know:

  • What happened to Red Widget Company’s pilot in Belgium in 2024? Was it shut down after the pilot completed, or did it transition to a production system?
  • Is anyone else piloting or deploying the novel technology in Belgium?
  • Is Red Widget Company pursuing pilots or deployments outside of Belgium?

Answering these questions adds more detail to a competitive analysis, making it richer as you fill in the blanks.

Ceasing continuous monitoring

But sometimes you don’t want to update things any longer.

I launched a client analysis project in the spring which required me, among other things, to monitor the Department of Homeland Security’s Silicon Valley Innovation Program. So I continuously monitored the opportunities list in the spring and the beginning of the summer.

After finding no new opportunities, I dug deeper.

Turns out the Silicon Valley Innovation Program was a five-year initiative that started in May 2021…and ended in May 2026.

No need to keep on visiting THAT opportunities site.

Cadence of continuous monitoring

How often should you revisit a question for continuous monitoring?

It depends.

Perhaps every day for critically important questions for which you need market or competitive intelligence NOW.

Or maybe every week.

Or possibly every month.

Whatever makes sense.

Just don’t stop monitoring, or you may miss something.

Or bring in an experienced analysis consultant like Bredemarket to monitor your items of interest.

Learn more here.

https://bredemarket.com/mark/

Stop losing prospects! Use Bredemarket content for tech marketers

“Universal” Login.gov Access Within Two Years

Well, Memorandum M-26-18 is out.

“SUBJECT: Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services”

That pretty much says it all. More details on the problem:

“Agencies currently use a range of distinct digital identity solutions. This results in members of the public often needing to maintain multiple sign-ons to interact with agencies and services. It also results in agencies needlessly reverifying an individual’s identity, often at a significant cost, where an existing verification could satisfy operational requirements. Further, agencies often pay commercial vendors to verify identity attributes for which the Federal Government may itself maintain an official data source.”

The solution is “universal” adoption of Login.gov within one year for some sites, within two years for others.

But does universal mean that it is available, or that it is the sole supported method? I was just at a federal website this week that allowed me to authenticate with either Login.gov or ID.me. Other websites apparently use Clear. Will the alternate options disappear in the future?

Maybe not. The Memorandum allows use of other solutions, but agencies should continuously re-evaluate if they are still needed. Or as Biometric Update put it:

“That makes the final policy more than an instruction to add Login.gov alongside existing systems. It establishes an explicit presumption in favor of consolidating federal authentication and identity verification around the government-operated platform while preserving exceptions for services and users Login.gov cannot adequately accommodate.”

Technically not a rebuke of private enterprise, since Login.gov works with some private vendors as technology partners.

Let’s see how this plays out.

In 2026, Multimodal Biometrics STILL Isn’t the Leading Modality

So the Biometrics Institute released its 2026 industry survey, and we non-Institute members can download an executive summary of the report.

So I did.

(I talked about a previous survey here.)

I will take the liberty of reproducing one small portion of the executive summary:

“While face at 45% continues to be the biometric expected to lead growth over the next few years, combining to or more different biometric modalities has nearly doubled from 11% last year to 21% this year. Furthermore, when asked which modality is expected to increase significantly over the next few years, multimodal leads the wider field at 40%, up from 29% last year, as combinations become the practical answer to evolving threats.”

My question: why isn’t everyone using multimodal (and, for that matter, multifactor) TODAY?

The answer is that it’s so danged easy (i.e. frictionless) just to take a selfie and be done with it.

But is the use of a single modality wise? Perhaps in non-critical applications, but the critical ones had better rely on more than one modality or factor for authentication, and definitely for identity verification.

Managing Privacy When Your Face is Your Password

We know the damage that can happen when people steal passwords. But other stolen information can do harm, including facial templates.

Non-password authentication

I’ve been writing some use cases around the common “selfie plus ID” method.

  • Usually you use facial recognition plus a government-issued ID (such as a driver’s license) to enroll in the system and verify your identity. (Although you could use other factors.)
  • Usually you use only facial recognition (against the template stored from enrollment) to authenticate your identity. (Again, you could use other factors, even a password.)

If the identity mechanism is centralized, you don’t store a password, but instead store a biometric template.

The threat of theft

What happens when—not if—the central storage is hacked?

Even if the storage is decrypted (you did encrypt the data at rest, right?), all may not be lost. Biometric templates from one vendor may not be usable by another vendor’s system.

But even in the worst case scenario in which someone steals and reuses someone’s biometric template, it’s practically useless if the system guards against presentation attacks (liveness) and injection attacks. With those guards, you need more than a valid template to get into a system.

And for those who respond that decentralized identity is the perfect solution…edge devices can be hacked also.

The threat to privacy

But those are just the technical issues. You have to deal with the business issues.

Because the theft exposes personally identifiable information, which may result in legal issues.

Depending upon local law, you have to inform your users of the breach, potentially disclosing what data was breached.

What now?

Are you ready to deal with the business consequences?

Bredemarket can help you get ready.

Drive Content Results with Bredemarket Identity Firm Services

How Other Experts Refer to “Somewhat You Why”

Unlike most other posts that appear under my name—Bredebot posts are another matter—this post breaks my 2023 rule because most of it was written by Google Gemini, not me.

But I figured that if I wrote a book specifically about SIX factors of authentication…

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket. Click on the image to purchase.
The book.

…it would be nice to know if other experts held similar thoughts.

My prompt to Gemini

Bredemarket has promoted “somewhat you why” as a sixth factor of identity verification / authentication. Has anyone else shared similar observations?

Gemini’s response

Here is the short answer: Yes, industry experts and security frameworks strongly agree with the core observation, though they call it “Authentication Intent,” “Intent Verification,” or “Context-Aware/Risk-Based Authentication” rather than using Bredemarket’s play-on-words.

Shifting Truths. Google Lyria. Public Domain.

John Bredehoft (Bredemarket) coined “somewhat you why” to fit the traditional naming convention (something you know, have, are, do, somewhere you are). His argument is that checking why an action or request is taking place—evaluating intent, transaction risk, or reasonableness—functions as a crucial safeguard, especially in an era of deepfakes and automated AI agents.

While the tongue-in-cheek name is unique to Bredemarket, the concept itself is widely discussed and implemented across the cybersecurity industry under three main paradigms:

1. “Authentication Intent” (NIST Standards)

The National Institute of Standards and Technology (NIST) explicitly addresses intent in NIST SP 800-63B.

  • The Problem: A user might have a valid session token, biometrics, or physical key plugged in, but malware or a session hijack could trigger actions without the user’s conscious decision.
  • The Solution: Systems require an explicit act of intent—like tapping a physical FIDO key, typing a PIN, or responding to a contextual prompt—proving that the user intended to execute that specific action at that moment.

2. Intent Verification for AI & Delegated Actions

With the rise of autonomous AI agents and automated workflows, identity security groups (like the Non-Human Identity/NHI movement) frequently discuss Intent Verification.

  • Conventional authentication proves who logged in, but not whether the user meant to perform this specific action.
  • Intent Verification bridges authentication and authorization by evaluating whether a transaction (e.g., a $35M wire transfer or an API call) aligns with the user’s actual current decision and business policy.

3. Context-Aware and Adaptive Authentication

Identity providers (like Palo Alto Networks, Okta, and Silverfort) build their Adaptive Multi-Factor Authentication (AMFA) around the “why” and “context”:

  • Context Signals: What resource is being accessed? Is this normal business behavior? Does this request make sense given the time, value, and sensitivity?
  • Dynamic Step-Up: If the “why” seems low-risk (e.g., checking internal docs during work hours), access is smooth. If the “why” is high-risk or suspicious (e.g., a wire transfer requested via video call), the system demands step-up verification.

How the Views Compare

While most identity security professionals treat “intent and context” as a governance or risk engine layer wrapping traditional factors rather than a 6th factor itself, everyone agrees with Bredemarket’s baseline premise: verifying who someone is without evaluating what and why they are trying to do it is no longer enough to stop modern fraud.


From https://blog.hubspot.com/customers/3-takeaways-from-start-with-why.

Double It To 200 Proof, Steve

Coincidence again? I discussed something from long ago and found myself dealing with it today. Sort of. Prove me wrong.

I recently had occasion to refer to a year-old post that warned about authenticating online customers with knowledge based authentication. There is no guarantee that the person on the other end of the line is actually your customer.

“JOE’S ALCOHOL EMPORIUM: Evelyn, what types of alcohol do you prefer?

“EVELYN’S TEENAGE SON WHO KNOWS HER PASSWORD IS HIS BIRTHDATE: 200 proof, man! Let’s get wasted!”

His mom is gonna be so mad…

Meanwhile Steve Craig—formerly of PEAK IDV, now with Prove—is participating in the launch of a new podcast.

Its name?

100proof Powered by Prove.

Steve, should you double the proof to attract the drunken teenager crowd?

Google Gemini. Deepfake. This is not real.

I guess not, since these aren’t Prove’s hungry people…I mean thirsty people.

But if you are in Prove’s…um…target audience, you will be (as LinkedIn says) excited and thrilled to learn that 100proof’s first guest is Steve Craig’s coworker Frances Zelazny, who has joined Prove as its General Manager of New Market Initiatives. Zelazny offers immense expertise in the identity industry. In fact we were coworkers for a few months at Safran, but she was on the other side of the impenetrable wall between MorphoTrust and MorphoTrak.

Join Steve and Frances today at 2pm Pacific Time on LinkedIn.

Despite the Friction, I Read This Message Anyway. And Wished I Hadn’t.

I simplified my social life a few months ago by no longer posting on Instagram. I don’t even have Instagram on my phone any more.

But Instagram Meta-relative Facebook is “nice” enough to inform me when I receive Instagam messages, as well as unsolicited Instagram message requests. Which I obvously can’t read on my phone (in part because I also removed Meta for Business).

Joining the “brand ambassador” inner circle

So one day when I happened to be on my laptop, I brought up my Instagram account. I wanted to see the latest message request, reportedly from “Navin Nandra”…even though I already knew it was in a languge using the Cyrillic alphabet. And probably wouldn’t bring Bredemarkeet a ton of business.

So here’s what I had to do:

  • Go from my phone to my laptop.
  • Log in to Instagram.
  • Find my message requests.
  • Translate the message request that I received.

After translating, I was right in guessing that this was a waste of time. Here is how the message began:

“Good day! This is the brand manager for the clothing brand PRIME Wear

“I’m messaging you from a tech/alternative account—we use these to avoid getting blocked by Instagram Direct limits.

“We absolutely love your style and the content on your blog!

We would love to invite you to join our inner circle of PRIME brand ambassadors.”

Um, no. These “we love your style” messages are always amusing to me. Especially when account number one tells you to contact account number two. Because reasons.

Google Gemini.

Yeah, “ambassador.” My last name isn’t Jenner, and my look isn’t Jenner either.

Google Gemini.

The underlying scams

So I asked Google Gemini about the scam behind these amazing offers, because I suspected a scam. To please me, Google Gemini said that there are scams related to this. I could have fact-checked this on a live web page, but I had already wasted too much time on this.

Here’s one of Gemini’s reported scams:

You are told you have been “hand-picked” to represent the brand. They offer to send you jewelry, sunglasses, or clothing for “free” so you can take photos with it.

  • The Catch: They give you a discount code that brings the item’s cost to $0, but you have to pay $10 to $15 for shipping.
  • The Reality: The brand is usually a front for a dropshipping operation. They buy the items from bulk wholesale sites for less than $1. Your “shipping fee” actually covers the cost of the item and gives the scammer a profit.
  • The Outcome: You paid full retail price (or more) for a low-quality, cheap item, while giving them free advertising.

Bad enough, but it could get a lot worse.

Some requests are much more malicious. A “talent scout” or “brand manager” will message you offering high-paying sponsorships ($500+ per post), even if you only have a few hundred followers.

  • The Catch: To “set up the partnership” or “verify your account,” they send you a link to a portal or ask for your 2FA (Two-Factor Authentication) code.
  • The Reality: The link leads to a fake Instagram login page designed to harvest your password. If you give them a 2FA code, they will immediately change the email associated with your account, lock you out, and hold your account hostage or use it to scam your friends.

So “Navin Nandra” is now blocked. And I can avoid Instagram again for a while.

Even Jedis Can Face Ephemeral Challenges

From a recent Identity Jedi post.

“NHI visibility and AI agent visibility feel like the same problem. They’re not. A service account is relatively static. It was created for a purpose, it has credentials, it authenticates to something. You can find it, document it, rotate its credentials, put it in a vault. That’s a solvable problem with existing tooling.

“An AI agent is different in almost every dimension that matters. It’s dynamic. It’s often ephemeral. It doesn’t have a fixed identity. It borrows one, or several. It makes decisions at runtime about what it needs to access. And it operates at machine speed, which means by the time your SIEM fires an alert, the transaction is already done.”