The Connector Podcast - nextAuth

Welcome to the Connector Podcast, an ongoing conversation connecting fintechs, banks, and regulators worldwide. Join CEO and founder Coen van der Huydonk as you learn more about the latest available trends and solutions in the markets.

Welcome to another Connector episode, and today I've got with me Ru, Ru van NextAud. What is it? What is your company all about?

Hello, Koen. So NextAuth is about user authentication, and we started this company while we were still at the university and we were looking into what banks were doing at that time.

Oh, interesting. That's really a topic for, for the podcast today. Yes.

So we thought we could do better, and that is why we started the company.

And in which perspective could you do better for a bank?

So we think we can do better in terms of security, but also in terms of user-friendliness, making sure that there is no friction for a user. So it's very easy for a user to log in, but you also have like the highest level of security you can possibly get with a mobile device.

So we're literally in the domain of logging in. So authentication while logging in.

Logging in, e-signatures, all that kind of stuff.

The whole shebang.

Yeah.

And interesting. And you said you were a spin-off from a university. That's not the typical route for a fintech startup. So what did that mean for you guys?

So that means coming from academia instead of industry, that we are actually 10 years ahead of what is happening in industry. So actually many cool technologies that we can incorporate directly into our product, but also It gives us still a lifeline to what is actually happening in research. And if we see cool things, we pick it up and we integrate it.

It also is a very bold statement. And many of us probably know what it means to have the benefit of being the first mover. Does that also apply to you?

I wouldn't say we are the first mover per se, but we are one of the first movers. So I think there is about 5 to 10 companies in the world that work on our level. It's very interesting, but also sometimes it's a bit of a disadvantage because to really tell the difference between you and other companies, you have to go very deep, very technical. And yeah, sometimes that works, sometimes that's a bit challenging.

And you say there's about 5 other companies worldwide. Are you like in contact with them? Are you like in competition with them? How does that work?

Yeah, so there are some other companies that work on similar things, but they're not located in Europe. So that's an advantage for us. And I would say the market is big enough for everyone. So I don't really see an issue there.

That makes sense. So you guys are into the mobile passwordless multifactor authentication. That's a mouthful. And that can enhance the user experience. But how does that enhance compared to the more traditional authentication methods?

So for starters, you don't have to put in a username and a password anymore.

So, wow, that's already a start. So what does that mean? So no username, no password?

Nope. Simply scanning a QR code or receiving a push message on your phone. You open the phone, you approve the transaction or the login. using your PIN or your biometric, and that's it.

Wow. So no more SMS passwords. It almost sounds there is no multi-factor authentication, but probably I am wrong.

Yeah, that's the secret sauce. So we also do a lot of public key cryptography inside the app. We also make use of like all the system features available. And we actually make sure that everything is mingled well together such that you cannot break one mechanism and replace it with another.

Because I'm just a very simple guy when it comes to multi-factor authentication. So my understanding is always there is more than one factor to authenticate yourself. Does the public key cryptography mean that this is an additional step or does it replace another step?

So basically all the public key cryptography is running on your phone. Inside the app. So actually, the first factor is the something you have, the phone. Your phone with your app installed on it, that's the first factor. The second factor is then a PIN or a biometric, where we also verify the second factor in a very specific way, together with the help of the server, such that you cannot brute force the PIN locally, but also not on the server.

Mm-hmm. And when I heard you talk before this call, when you say not on the server, I think that's one of the weakest points maybe of all the others currently in the market, right?

I wouldn't say it's a weak point per se, because like lots of financial institutions use very expensive secure hardware modules on their servers to actually take care of verifying a PIN code securely. With our solution, you wouldn't need those. So that's actually the big advantage, is that the server cannot actually learn the PIN in any way.

So do I hear between the lines that your application is more secured, it has a better user experience, and at the end is also cheaper for an organization?

It would definitely do a cost-benefit, but Yeah, it's hard to say how much exactly.

No, I understand. What are the potential challenges organizations may face when transitioning from traditional authentication into the authentication that you provide?

So traditional authentication is typically username password. And one of the biggest challenges that companies have when going from a password way of authentication to a passwordless way of authentication is that there is not one system. Typically—

Okay.

There is like 100 systems running, and every little system has its own way of dealing with username password. And before actually going to a passwordless system, it's usually recommended to put some kind of single sign-on in between so that all all your applications actually talk to one place where you do the authentication instead of replicating it everywhere, as is happening a lot with legacy systems.

Would you, to come back to the first mover advantage, would that then be something that this is a negative element of the first mover advantage? Because ideally this already should be in place with everyone, which would make your life more easy because you sit in front of the single sign-on And off you go.

Yes, indeed.

Can you provide some examples of industries or sectors that would particularly benefit from the way you work?

So there is no specific industry or sector that would benefit from it.

That's a too easy answer rule. Too easy, but continue.

So basically everywhere where you have like a lot of users, 10,000, 100,000, a million users that need strong authentication. So typically, if you're having access to more sensitive data, or if you can approve financial transactions, that kind of stuff, and you actually want to make sure that you also have like very strong non-repudiation so that you actually have proof that the user authorized something. Afterwards, that's something we can provide.

And if we talk about a million users, then you very easily come to banks or financial institutions. Is there a specific use case for them?

You can provide like the highest level of security, give strong non-repudiation guarantees so that if a customer afterwards says, for instance, I didn't approve that transaction, you can actually show that they approved that transaction using their phone. using their PIN or their biometric. And you can even include other things in the proof, like location data, or even like a screenshot of what was actually being displayed to the user at the point in time where he approved the transaction.

So this sounds like something a compliance person would really like because it's traceability.

Yes.

Yeah. What Well, a couple of months ago already, well, both of us, we participated in a trip to Singapore to figure out how the market is going in Singapore. What have you found? Was it the same as in Europe in terms of the banking industry and authentication?

The big difference between Europe and Asia is that a lot of SMS authentication is still being used in Asia. Nowadays, they also start realizing in Asia that this is not the best way to secure the device.

SMS fraud, as they call it.

Yeah, actually, from a user perspective, this is also not the nicest thing because you're logging into your bank account, but at some point you need to go out of that, like check your SMS, enter that back in your application. So if you can nicely integrate like the entire authentication into your mobile app, your users also gain in user experience.

It's all about the user experience in this case. When we were on the trip, I know that you were out and saw a couple of prospects. So how was the trip for you?

It was very interesting also to see how business models are completely different in Asia. So that gave us a lot to think about. And yeah, we'll see what we will do there.

No, then that's what the research people are for, right?

Yes.

Roel, I thank you very much for participating to this podcast. It was a real joy to have you. But before we close off, if people want to get in contact with you, how do they reach you?

I guess it's best to check our website, which is www.nextout.com.

That makes a lot of sense. So thank you again for participating. Thank you also to the audience and stay tuned for more fintech news. Thank you so much.

Thanks for listening to another episode of the Connector Podcast. To connect and keep up to date with all the latest, head over to www.jointheconnector.com. Or hit subscribe via your podcast streaming platform.