Possibly, but it's also easy to pick up someone's fingerprint from anything they've touched after the fact. With faces, you have to actively record/3D scan someone. It's not clear whether e.g. security cam footage will be sufficient fidelity to reconstruct a 3D face in enough detail, but this will be interesting to find out.
In case anyone missed it, Apple claimed false positive rates for Touch ID were 1 in 50,000 and for Face ID were 1 in 1,000,000.
> Statistics about the false-positive rate are mostly meaningless in an adversarial case.
I imagine what those special effect masks were for, to test for the adversarial case. I also imagine that's why there's an IR camera too -- I'm not sure what wavelength of IR this is, but it seems distinct from the depth mapping, and would be more difficult to fool on a mask.
That would be NSA-grade security cameras, and based on the photorealistic masks they tested, even that shouldn't be good enough.
But it's not yet clear how much photorealism matters vs. 3D shape, which may be a lot lower fidelity.
edit: or even a fake iphone and I hand you mine and ask you to play a game that I'm building that steals your face data.
The basic idea (as I understand it) it to project a grid of even dots (or some other known pattern). Once they land on a 3D surface you can tell how close the surface is by how close together the dots are and how angled the surface is based on how the dots skew.
It requires the projector, a camera, and the distance between the two. But it's relatively simple (in theory, I imagine it's quite hard in practice).
If the identification requires just image, it could be printed on a black paper with IR ink (or just white?). Apparently they also look for life signals, so it might require video. In that case, it can't be produced with normal display, but maybe with some sort of old-school analog film and IR light.
This kind of attack (if it works) could be mitigated by adding random IR dots, which would be different each time.
It produces a 3D model of your head so paper definitely wouldn't work.
It would be a phenomenal oversight on their part if they failed to do this. As in, the only reason I wouldn't deem it criminal negligence would be because the legal bar for that WRT people's personal data is so low.
Par for the course if Samsung doesn't do it.