Hacker News Reader

Comment by Osmium | Hacker News Reader

> Faces are less private than fingerprints

Possibly, but it's also easy to pick up someone's fingerprint from anything they've touched after the fact. With faces, you have to actively record/3D scan someone. It's not clear whether e.g. security cam footage will be sufficient fidelity to reconstruct a 3D face in enough detail, but this will be interesting to find out.

In case anyone missed it, Apple claimed false positive rates for Touch ID were 1 in 50,000 and for Face ID were 1 in 1,000,000.

> Statistics about the false-positive rate are mostly meaningless in an adversarial case.

I imagine what those special effect masks were for, to test for the adversarial case. I also imagine that's why there's an IR camera too -- I'm not sure what wavelength of IR this is, but it seems distinct from the depth mapping, and would be more difficult to fool on a mask.

View on HN

> It's not clear whether e.g. security cam footage will be sufficient fidelity to reconstruct a 3D face in enough detail, but this will be interesting to find out.

That would be NSA-grade security cameras, and based on the photorealistic masks they tested, even that shouldn't be good enough.

> photorealistic masks

But it's not yet clear how much photorealism matters vs. 3D shape, which may be a lot lower fidelity.

The thing I've been wondering about is the "invisible dots" that they map to your face, obviously they are visible to something, and if someone wanted your face info could we build something to capture that data either en masse or say with a sensor built into a doorway or such.

edit: or even a fake iphone and I hand you mine and ask you to play a game that I'm building that steals your face data.

Look up Microsoft's Kinect.

The basic idea (as I understand it) it to project a grid of even dots (or some other known pattern). Once they land on a 3D surface you can tell how close the surface is by how close together the dots are and how angled the surface is based on how the dots skew.

It requires the projector, a camera, and the distance between the two. But it's relatively simple (in theory, I imagine it's quite hard in practice).

right, that's my point, what does an iphone face id-ing in the vicinity of a Kinect look like? I'd can't wait to read about what fascinating ways people figure out to attack this.

I was wondering the same. I think it might be quite easy to capture the IR video for replay attack, but it's quite hard to reproduce. Capturing would require just a device that replicates iPhones camera setup, and storing the IR image. Or just use iPhone if you can somehow access the raw IR image data.

If the identification requires just image, it could be printed on a black paper with IR ink (or just white?). Apparently they also look for life signals, so it might require video. In that case, it can't be produced with normal display, but maybe with some sort of old-school analog film and IR light.

This kind of attack (if it works) could be mitigated by adding random IR dots, which would be different each time.

We know how the identification works courtesy of the Animoji.

It produces a 3D model of your head so paper definitely wouldn't work.

You can print the IR projection pattern on a paper and it looks the same to the camera.

Reply on news.ycombinator.com