Hacker News Reader

Comment by mikeash | Hacker News Reader

Apple claims that the odds of a random person's finger unlocking your iPhone with Touch ID is 1 in 50,000, and the odds of a random person's face unlocking Face ID is 1 in 1,000,000.

View on HN

That's interesting. I would think that identical twins would be very hard to distinguish... and those certainly have an almost 1:350 odds. Of course you're likely to know them, but still I'm not sure banks would be happy with that for FIDO.

They did say to not enable Face ID if you have an "evil" twin, which is pretty jokey, but probably 100% true.

A twin could walk into any bank with their sibling's passport and do anything they wanted.

Banks are all about risk management not necessarily avoiding and and all risks.

But a twin wouldn't be able to unlock my iPhone 7 with their finerprint.

You just disable FaceID in that scenario and go back to using a passcode.

But again if you can't trust your twin well then your phone is the last thing I would be worried about.

I think the number is if you choose another human at random, how likely is it that they'll be able to unlock your phone. Having a twin doesn't change that number much, since they're only one person out of 7+ billion. Of course, your threat model may be different from "pick a random human from anywhere on the planet."

> I would think that identical twins would be very hard to distinguish

Ask their mom. (Hint: They're not.)

The twin's mother is inside the phone telling it what to do? Or the person you replied to is talking about technology finding it difficult to distinguish, and not a close family member?

My point is that twins are only difficult to distinguish for people who do not know them. For family and friends it's easy, which means that there are substantial differences even for faces of twins. The face detection technology will be able to recognize those differences as good or better than the twins' family and friends. If it does not now, it will eventually.

If you want to teach Face ID to reject masks, you need to make some masks. Similarly, if it needs to be taught to reject a twin, you need dozens of twins. And if it starts labelling people incorrectly as their twins, is it worth it?

Perhaps they can sidestep this by offering a specific twin learning feature.

Twins are just examples of two people with very similar faces. If Apple are able to train Face ID to distinguish between 6 billion different faces they will also be able to distinguish faces of twins.

I wonder what the odds are of someone unlocking your phone with a picture of your face? I've heard lots of biometrics companies say that their system is immune to such simple hacks in the past, only to immediately fall to such simple hacks in testing.

This time they’ve got an infrared sensore, as well as two cameras with different focal lengths, so they should be fine.

I believe it uses an IR camera, or similar tech, defeat that, sensing depth. Kinect style. A photo won't defeat it.

Reply on news.ycombinator.com