John Duffy

What happens when a late-night napkin sketch turns into a mobile app that must pass TSA checkpoints and government audits? This is the real-world story of how we partnered with an ambitious state government to transform the physical driver's license into a Digital ID — a mobile identity platform trusted by police, retailers, and airport security. Built from the ground up, the app enables users to prove identity, purchase age-restricted items, and even board flights — all from their phone. But this wasn't just an app launch. It was a high-stakes journey where security was the product — and there was no playbook to follow. In this 45-minute talk, we'll walk through the technical and organizational gauntlet we faced, and share real artifacts, patterns, and missteps from taking a net-new product through: - SOC2 certification (including the app, cloud stack, and even manufacturing plants), - biometric verification challenges, - evolving privacy regulations, - and eventual TSA acceptance. Updated in this version of the talk: We'll highlight lessons learned post-launch — what worked, what didn't, and how real-world usage patterns forced critical design changes. We'll explore how some well-meaning security decisions, like one-time tokens or strict expiration windows, backfired by confusing users or blocking adoption — and how we course-corrected under pressure. You'll walk away with: - A reusable blueprint for building certification-ready products from scratch. - A DevSecOps pipeline pattern that enforces security, triages defects, and feeds directly back to developer queues. - A proven threat modeling approach that builds cross-team trust fast. - Tactics for executive risk scoring that move audits and legislation forward. - Lessons from breaking (and fixing) facial recognition, blockchain-based claims, and 3rd-party identity verifiers. - How to detect and resolve security features that hurt usability or adoption, including warning signs from live telemetry, user support channels, and conflicting 3rd-party expectations. We'll unpack key stories: - How digital identity actually works — and how to test what can go wrong. - Where real-world standards failed us — and how we adapted. - The surprising ways 3rd-party assurance almost derailed launch. - What happens when a production endpoint is stolen and taken to a dark alley. - Getting TSA sign-off (and how our users helped us get there). If you've ever been told "make it secure and ship it fast" with no roadmap and public scrutiny looming — this talk is your playbook