The Startup Hero with Tim Draper Episode 6: Kari Thor Runarsson

Welcome to Startup Hero. I'm here with Kari. Rasmus Runarsson, and he runs Authenteq. And Kari, why don't you tell us about Authenteq?

Sure. So Authenteq is an identity verification and private information management platform that verifies a person's real identity and then issues a government-grade digital biometric passport that the user can use to authenticate and verify themselves when doing business online.

A biometric passport?

Yep.

And so how would they— a physical passport?

No, so it's digital and it's saved on the user's phone and in the blockchain, and all the information is only accessible by the user himself. So Authenteq or anybody else doesn't have any access to it, so it's user-controlled and owned.

So you've got this What's a digital passport? And then what's the benefit to the user?

Well, I mean, one of the things that we've been going through now is we opened up a branch or an office and a daughter company in Germany, and that's taken over 4 months to open a bank account. It's taken 4 trips to Germany to open one bank account, always because of some issues with the bank, at the banks, and they They did the KYC, the know your customer process, which all banks have to put their users through. And every time there's been some problem, they photocopy the passport, the copy was too dark, they needed a signature. So I've had to go back and forth 4 times to Germany to do that. With something like Authenteq, you could do that across borders or from a location that's not So now, but I have an Estonian card. Me too, yeah.

And I opened a bank account in 24 hours and it works for the whole EU. So why wouldn't people just do that, become Estonian virtual residents?

Well, I think a lot more people should do that. And basically it's not too dissimilar from the Estonian eID. I'm from Iceland originally, and so I have an Icelandic EID, and most of the Nordic countries have EIDs. The problem and a huge limitation to the EID programs that are out there, including the Estonian one, is that—

EID is electronic identification. Yeah.

Is that you can only use it inside that country. And even inside the country, it's fairly limited. It's usually limited to government agencies, you know, filing tax returns and stuff like that. With Authenteq ID, we allow the user to use that same concept, but across borders and in any country. It's also a lot easier for companies to participate, so they don't have to go through a huge bureaucratic process of being part of that system. So, you know, a gym or a hairdresser could even do that.

So if I have this ID, electronic ID from Authenteq, Is it less likely to be hacked, or is there— and do I use it every time I've got to make a payment, or every time I open a bank account, or trade, or do any of that?

The way it's used by the online service that's our customer is up to that service. They can use that to verify a person once, or they can use it if they're doing a purchase that's high value. An auction site might want to put a threshold on anything over $1,000. They need somebody to sign up with Authentiq ID. So yeah, it's very versatile in how to use it and it can be used in so many different fields.

So let's— okay, so is the biggest use case the bank or the government or the individual? Who cares about it the most? Or Target or Sony, the people who get hacked? Yeah, yeah, yeah.

Well, again, one of the main benefits is that it is on a blockchain and only the user has access to that blockchain entry. So, and each entry is even separately encrypted on the blockchain. So hacking it is not impossible, you know, nothing's impossible, I guess, but the amount of energy and work you need to go through that to hack somebody to get his birthday or whatever is just beyond what anybody would do. Yeah, so it's unhackable in that sense.

Okay, it's unhackable.

So how— My CTO won't like that I said that.

What's my purpose in having this? Is to be more secure or to prove I'm me?

To be more secure and prove you're you. A lot more convenient than going 4 times to Germany to open a bank account, for instance.

Sure. Because why? What do you have for me that I can take to the German bank so that I can open it just like that?

So one of my co-founders has been working on electronic ID schemes in 2 Nordic countries, and we're trying to have that level of accuracy and security, but at the same time keeping convenience of the user being able to do this verification from his home or office. With the current eIDs out there, you always have to go to physical location. Like with Estonia, you had to go to an embassy or a consulate to get your eID. Authenteq is completely automatic and from your office or home.

So how do you know it's me? Is it a face recognition, a fingerprint? Password, some combination of them?

Yeah, so we start with really the only way of truly what's called entity identity binding, which is binding the entity, which is you, to the identity, which is what your government has issued you, which is your passport. On your passport, we access the chip of the passport because we get information that's visible, so there's nothing that secretive. The information that's printed on your passport, we can get access to digitally. So we get a digital copy of your picture. We— you take a selfie yourself and then we match those 2 pictures. We make sure that the passport is— hasn't been changed in any way or modified.

You match them automatically?

Not with a human watching?

Okay. Match them.

Match them. Make sure that the person that's taking the photos is a live person and not a video.

And how do you know it's not just a photo?

We do Magic.

Oh, okay. So somehow you can keep it from— you can beat a video. Like if I have a really high-quality video of me moving like that, someone else can't use that.

Correct.

And you've got a way of making sure that doesn't happen.

Yep.

Okay. And is that your secret sauce? Is that your reason for your life?

That is part of it. The main secret sauce is, I would say, the business model.

What is the business model?

So, the business model is that the user can adopt this without charge and can use this without charge. It's always the online service that's paying for it. Depending on, so for instance, a financial institution would, this is, they would, so according to numbers in Europe, a KYC check, manual KYC check by a bank costs about €50 or dollars. We could lower that substantially. And adding to that— How?

How would that happen?

Just because the price of the automatic process using the app is a lot lower.

So they would use your app, and on your app would be, hey, this is Tim Draper, and here he's been verified.

Yep.

After you've given consent And you have 99.999 whatever likelihood that this is Tim Draper.

Yeah.

Okay.

After you give consent, it's always your consent.

So I give consent for the bank to use this.

Yes.

To use Authenteq. And then the bank can do all their work just electronically, quickly, and that will help them move money or do whatever they have to do.

Yeah, so for instance—

And they're the ones who are going to pay you for it.

Yes, exactly.

And why is that a unique part of your business? You said the business model. Is there something more to the business model?

The part that's maybe more unique is that we don't claim any ownership of the information. So we're not trying to make money from the information of the user. We don't even know the information that you have there. It's all controlled by you. You're the holder of the private key to the blockchain entry. So we never know really what's going on there, and we're not trying to monetize off that information.

I see. So it becomes just scrambled up in the data sphere somewhere, and I have my— I keep track of all my data, and that can include, what, my credit card number and my Social Security number and my Passwords and whatever else, and you never see it. But you take all that data and you say, and you put my face on it, and you say, that's that person and they're attached to that data and it's on this blockchain.

Right. So information that you need to verify to a third party from that pool, you can do, and you decide what information is being shared.

So would this be sufficient enough to be Done, like, I mean, I think of Target. Would this be an efficient enough way for Target to use this and just every time a new customer comes through with a credit card or whatever?

Right. So part of our process is that the onboarding process, the first time you do this using the passport, takes about 60 seconds. After that, you've done the process. You don't need to do that every single time. You want to verify your identity to an online service. So after that, it takes about 2 seconds. So we've lowered the threshold of connecting your ID or verifying your ID to multiple sites down to 1 or 2 seconds.

Are you ultimately going to have people just go and buy things and then just walk by and take the stuff, maybe put their finger down, or—

We haven't really thought of it that way. Part because we don't want to interfere with buying habits or anything like that. So, you know, there is a possibility of using this as a single sign-on. We just don't want to do that. We don't want to get that Big Brother stamp on us.

Yeah.

So it's always up to you. You always give consent. And maybe a better example than Target would be like Ashley Madison. You sign up to Ashley Madison, they know a lot of personal stuff about you.

Right.

That was then ultimately hacked. Using Authenteq, the only thing Ashley Madison or any dating website really needs to know is You know, are you a male or a female? What age are you? And are you a real person? So we can tell Ashley Madison that Tim Draper is a male, he's this age, and he's been verified. And we know who he is, or he's been verified up to a very high accuracy. And that's all Ashley Madison really needs to know for you to be a good user on the site. So if it is hacked, They won't get your name because that will never be in there, and it's really none of your business. It's none of their business if I am on a website, whether or not I should be there.

Right. And the— would you put medical records on something like this?

It's definitely— there has been interest from the medical community doing that because that is a huge problem, especially in, like, in the States where you have no centralized databases. In many of the Nordic countries, you have central— in Estonia, you have a centralized database with medical records and government records. But in places like the US, you don't have that. So that's definitely something that could be added.

How much— do you have any customers so far?

So we expect to launch in May. We're just finalizing and strengthening the product, strengthening the security features, the likeness detection, all that. So we have— we're working with development partners that are implementing this and giving us feedback. But yeah, so May, June, I would say we will go launch.

And when you launch, what's the plan? Are you going to launch and then start talking to some of the high— are there some smaller customers you can go after that might be earlier adopters? Or do you have to go after these big ones that have the big problems?

I think to begin with, we'd talk to the smaller ones simply because it's easier to get access to them and get a meeting with decision makers. I've been on the other side in previous startups where it's an enterprise sale and, you know, with a lead time of 9 to 12 months. At least first we want to work out all the kinks and make sure that it's really up to par because we don't want to send a, you know, a half-complete product out there. Our reputation depends on it being secure and accurate.

And do you have a few early customers that you really say, hey, these are going to be perfect candidates for us?

So, yes. So it's maybe twofold. It's marketplaces, auction websites, for instance, that there's a lot of damage that can be done by a bad actor that takes part in an auction. Even if he's not the winning bid, he can influence the bidding history. So they really want to manage that, that there are no bad actors taking part in an auction. And then you have the fintechs or the financial institutions where it's a matter of regulation. They need to subject their users to this process, and we can offer them a much more convenient way to do that and cheaper, which is not the main sales message, but that's— That's a good thing.

And are there competitive services that have something like this, or— and what do you have over them?

So, I mean, this is— when we started looking into this, there were not a lot of competitors. It's been growing, but part of what is common with all of them is that they're all using the user information to some extent to monetize off that. We really decided that that is the one thing that we feel the users are concerned about when we talk to users. Who owns my information? Who sees it? Who can access it? You know, is it— especially with the new laws, I think, in the US where internet providers get more access to users' information, people are very concerned about this. So by saying it's user-owned, controlled and consent, I think we have a clear differentiation from the other competitors.

And your, what do you call it, facial recognition or whatever the recognition system, is that unique or do other people have similar products?

No, so when we started out, we looked into our own, but really it's become a commodity.

There are several really good players that offer a solution at So you're going to go out and use theirs?

So we use the core, but then we enhance it. So because we're using, for instance, a provider that's doing the security for e-gates in Europe. So you go to a European airport and use the e-gates. We're using the same vendor that's doing the face recognition there. But we need, because in an airport you have a machine that controls the, the height of the camera, you have equal lighting from both sides. And obviously when you're at home, you might have more lighting from this side, which produces shadow here. So we need to correct those things. So, so the, the core matching algorithms we, we have from somebody else, but we need to augment that and enhance it.

And you've been bootstrapping for quite a while. What made you want to do So what made you decide this is something you really wanted to go after?

You just— so luckily I've been in a startup that had an exit, so I've been fueled by this foolish vision of, you know, I can do it again. Honestly, I think that if I hadn't had a successful exit there, I probably would have given up. But I know that if you're in this startup environment, you need to be— you need to realize that it is a roller coaster, that you will have a lot of downsides, that you will have a lot of hard times, times when you can't pay yourself and stuff like that. And because I was just more realistic about this journey, I think that's what's kept me going. And the feedback. I mean, we've gotten a lot of good feedback. We met at a pitching event where we came in second place. By the way, why second? You were on the jury. So yeah, just the feedback and realizing that the market is huge, the need is really big out there, and we see this growing to be really the core of your identity online. So anything that's Identifiable and verifiable can be added to that. And then you can use that not only for online sites, you can also use it, you know, checking into your flight. You have the digital certificate on your phone, you can use that anywhere. Checking into a hotel, all these places, you can eliminate a lot of lines, for instance, queues at different places. Boarding a 350-person airplane takes 30, 40 minutes. I mean, if you use a solution like ours, which is still in a prototype or idea stage, I guess, you could potentially get that done a lot quicker.

So this— could this replace the TSA?

Maybe not.

The security people at the airport?

No, but I think we could definitely cut down the checks and the lines. I mean, coming to the States last weekend, I spent 2 and a half hours in the immigration line. I was thinking like, this is not necessary.

And then you've got— you're based in Europe. Do you feel like you are going to just start in that market, or are you going to come to the US right away? Or is this going to be a global business?

Yeah, it's definitely going to be a global business. The good thing about starting in Europe is that most Europeans have a passport, and that is our main means of identification. We can use driver's licenses, for instance, and ID cards, but we're starting out with the passport, and it's just a lot more common for Europeans to have passports than Americans.

So you're going to replace the passport?

Oh, we use that to do the verification.

And will they use this instead of a physical passport in the future?

In the future.

But not right away? No, I mean, this is— So you're calling it a passport, but it's Really, it's a bank ID or an ID.

It's a digital ID.

It says, here I am.

We call it passport because it allows you to pass through.

Pass through certain things where they're looking for people to match. Well, that's great. Anything you've run across that you were frustrated by or you Are there any issues that you've come into as you've built this business? What's happened?

It's been quite a ride. I mean, we've done the pivot that I guess you need to go through. It started out as a very— it's actually kind of funny because it started out as a very simple app. So it started out as a mobile app that took pictures that you could verify. So, you know, we're taking collectively over a billion pictures a day. And I thought it was strange that, you know, once a photo used to be evidence in court. Nowadays you can take a photo on your phone, you can use Photoshop and change it, and you wouldn't even see the difference.

Right.

And I just thought it was strange that we can't trust this piece of evidence that was, you know, thought to be beyond all doubt. 20 years ago. So we started out making a simple app that just took a picture and it was encrypted, you know, the app talked to the hardware and was encrypted and timestamped and hashed and everything. So you could just, you know, this is what happened, this is actually what happened, and just evolved from there. So it's become a lot bigger and just the legal environment that we are in now, because just like the KYC regulation is this different between each country in Europe. It's similar, but it's always a little bit different. So yeah, it's just the complexity has grown a lot, which I really didn't envision when I started this.

Now, do you think that you're going to have to pivot again so that the business, you know, 15 years from now is going to look different or better?

No, I'm really content up until, you about 9 months ago, I always felt there was something missing, there was something that needed to be— like, not everything was falling in place. But I'm really happy with our vision, our solution stack, and everything. So I don't know. The only thing I see changing is that there's no reason why Authenteq couldn't become the, you know, the go-to ID when you're communicating or Or transacting online. And it will be as easy as just a 2-second verification, and you verify to an additional online service that you are who you say you are. So it could be as easy as, you know, hairdressers taking up because people are booking time slots and they're not coming. If your identity is verified and you know that it's connected to your real identity, you're more accountable for your actions online than if you can do it just behind some email that nobody knows where it leads to.

And just so I get it straight, when I verify, do I put a camera in front of my face? Yeah.

So the process is you download the app, you take a selfie, you scan the passport or the driver's license, and then the magic goes on behind the scenes.

Oh, okay. And well, that— wait, that's when you start?

Yes.

But then when I'm verifying, like Right. So, so florist or the hairdresser, then it's a matter of— it's just I take my camera and put it up in front of me?

That's— no. So, so the way to do it is that there's a QR code or a code that's displayed on the website, um, on my profile page. I take a picture, the QR code talks to the certificate on the phone, blah blah blah, and, and, and, and—

So it's not verifying the, uh, the—

That's only one time. That's only, that's only the initial However, we can use that as a backup. So if there is something fishy going on and there are some flags and we don't think that it is Tim Draper that's using the phone, that might be a backup method, like a 2-step authentication thing.

So the authentication is no different from a lot of the—

Not the core process.

You just type in a 6-digit number or something. And it goes. Or you— how do I get the florist or the salon to know it's me so that I can give money to them?

Yeah, so it would be like in the checkout process. It would be like—

Right, so I've got my phone. I'm in the checkout process.

And if you want to verify—

Show them a QR code or something?

No. So you click to verify to the forest, and there's a QR code that is retrieved from our servers. Take your phone, you snap it, and the phone and the website talk together, and you've verified.

I see. They get the QR code.

The QR code is displayed on their website.

On their website.

Retrieved from our servers.

OK. That's great. Happening already, that part.

Yeah, yeah.

Um, good. Well, thanks so much for being on the show. Yeah, yeah, terrific. So it's Authentiq. It's— how do you spell it?

So it's, it's Authentiq with a T-E-Q in the end.

T-E-Q dot com.

Yes. Terrific.

Great. So if any of you are interested in learning more about Authentiq, send them a, send them a message or go look at their website.

Absolutely.

Great. Thanks so much.

Thanks a lot.

Thanks for being on the show.

Thank you.

All right, so there's another startup hero.