Hacker News Reader

> it tried to read the people setting the phones up on the podium.

This sounds annoying. With Touch ID, unlocking the phone is a deliberate action. With Face ID, it sounds less predictable.

Well, I imagine people setting up the podium were taking good long looks at the phone, but I see your point.

AFAIK you need to be actively looking at the screen and touch the screen for it to unlock.

Simply glancing at the phone sitting on your desk will not cause it to unlock, as far as I can tell.

There's speculation that the demo failure was because they had staff clean/handle the devices before the demo - i.e., they both looked at the device and touched the screen. Of course, lots of uncertainty around this particular botched demo.

I agree. The guy who is stealing the phone basically has to show it to the owner's face before running away with the device.

- If there are 5 failed attempts to Face ID…

This is what the article says, but it's also been reported to take just 2 failures with Face ID before requiring a passcode (as opposed to 5 with Touch ID). I can't remember now if that was said by Apple directly on Tuesday, but I've seen the "2" figure reported several places, so I'm not certain which is right.

EDIT: It's apparently been clarified to be 5 on both Touch ID and Face ID — https://developer.apple.com/documentation/localauthenticatio...

Maybe it's user-settable.

I think this is the case for how many times a passcode can be entered before the phone is wiped.

No, that number is fixed at 10, with increasing intervals of time required between each attempt.

After 10 attempts, the phone is disabled until a restore, with the user-settable option of erasing the phone in this case.

But it's pretty simple to convert a depth map to a mesh, so I'm not sure how this offers protection. Perhaps the depth maps the developers are given are decently low-res?

Protection from what? You’re willingly pointing a 3D camera at your face and giving a 3rd party permission to use the data. What exactly are you seeking protection from?

Protection from an app developer reading the raw sensor data and unlocking Face ID without you being present.

What is the specific attack vector you're concerned about? How do you imagine one would weaponize the depth map?

How? They can't access the secure enclave. If they make a fake 3D mask out of the map identical to your face, it's not going to work either, they've tested that.

This isn't Samsung dumping underbaked technologies on the world. Apple actually puts some thought into these things.

Sure, we know that. Consumers don't know that. Hence the marketing line about developers not having access to the "raw Face ID sensor data".

I think the concern is more around privacy the face data: Apple says they don't store it on their servers or track it, but how good a model of your face can they get from the depth map they get.

E.g., would Snapchat or Facebook now be able to pull a 3d model of the face of all their iPhone X users into their own servers?

The 4 hour rule sounds VERY annoying. It means for example I'll be forced to type my passcode after waking up. So many years of Touch ID will make such a burden UNBEARABLE.

Absolutely unbearable. Borderline inhumane!

I think that's a misinterpretation. Here is the full quote:

> You’ll also get a passcode request if you haven’t unlocked the phone using a passcode or at all in 6.5 days and if Face ID hasn’t unlocked it in 4 hours.

You already need a password if you haven't used TouchID in 48 hours.

This rule seems to exist to make sure you have to enter your password after about a week if by then you go over 4 hours without using FaceID.

You don't need to use a password any time you go more than 4 hours. I agree that would be insane and would be much stricter than what they apply to TouchID (which they say is less secure).

EDIT: I notice the GP's comment seems to have been edited since the time you posted yours.

I copied the text directly from the article, unedited; it really is just worded poorly (I did the same double-take).

I remember thinking that when I read the article (I totally agree), but I thought you had summarized it earlier instead of a literal copy.

Sorry.

Once a week. It must be 6.5 days with FaceID-only unlocks AND 4 hours without FaceID unlock.

That's not the way I understand it. I read it as "you'll need the pass if you haven't unlocked with touch id in 6.5 days AND you'll need the pass if you haven't unlocked with face id in 4 hours"

This interpretation is very unlikely, given that it would be redundant with the first bullet point: "If you haven’t used Face ID in 48 hours [...] it will ask for a passcode".

Assuming that Apple engineers aren't stupid, the correct interpretation is "we want people to enter their passwords at least once a week so they don't forget them, but we also don't want to bother them if they're in the middle of something". So yes, once a week, you will be forced to type your password upon waking up.

I read it as "you need to enter your password if you haven't used your phone in a week, but if you use your phone every day, you only have to enter your password after each reboot"

That part was worded in a bit of a clumsy manner I think. It is in combination with not entering the passcode in X many days, as it already is with Touch ID (You may have already experienced this occasionally - waking up and randomly needing to enter your passcode instead of being able to use Touch ID).

The 6.5 days plus 4 hours rule is the exact same rule we've had with TouchID all along. Nothing changed in that respect.

It's clearly a typo in the article. It's 48 hours without unlocking with Face ID.

This is the same as Touch ID with the exception of the 4 hour rule and that you cannot get any data from the fingerprint sensor at all directly.

Touch ID had the same 4 hour rule. Note that the 4 hours time limit only comes into play if it's been 6.5 days since you last used your passcode. The full rule ensures that you need your passcode approximately once a week, and the 4 hour thing basically just means you won't be surprised with a passcode request 5 minutes after you successfully unlocked it with your face.