Hacker News Reader

How is this less secure?

I really don't see what's so bad. To use my phone I have to look at it. So as long as it unlocks fast enough (reportedly it does) them it's a non-issue.

> I unlock it when I get it out of my pocket.

Once you look at it, it will be unlocked.

> I unlock it while lying on the table when it's facing the ceiling.

Depending on how you're positioned this maybe an issue.

> I unlock it to peek at messages in meetings under the table.

If you can look at the screen from a reasonable angle then it can see you and unlock.

I wish people would stop bashing this stuff 15m after it's announced in the presentation. Let's see what the security white paper says. Let's see what reviewers who have been allowed to use it say (they couldn't enroll at the event).

Until then this is all straw man arguments (on both sides, my comments are based on Apple reasonably delivering what they promise).

> I unlock it when I get it out of my pocket.

Once you look at it, it will be unlocked.

It's a mistake to underestimate the impact of small delays. Developers ruthlessly cull their editor configurations to avoid little delays here and there. A delay every time you want to use your phone sounds annoying.

There are plenty of contexts I'd like to use my phone where face recognition isn't available: on a bus at night with no light, so as not to disturb others.

I understand the pain of delays, but I'm guessing hats not an issue. Apple tends to be pretty strict about that kind of thing.

> [...] on a bus at night with no light, so as not to disturb others.

That's why the phone has an IR light emitter, so it can work in total darkness. The images in the presentation where the phone lit the person's face up or projected dots on it were simulations to give you an idea what it's doing, but it's all done with IR.

It supposedly works in the dark, too - it doesn't just take a picture, it projects an infrared grid on the face to scan.

It would be kinda stupid to introduce a feature that may not work 50% of the time.

Its entirely IR based though, including a built in IR projector, so whether its night, or even completely pitch black, should theoretically in practice not matter at all. Given humans can't see the light from the IR projector I doubt it's going to wake anyone up either!

Interesting the phenomenon where although the original presentation...

1. Indicates it will recognize you in the dark (https://youtu.be/mMV_LcrZtLg?t=21m29s)

2. An accompanying video indicates it works in the dark (https://youtu.be/K4wEI5zhHB0?t=1m47s)

3. The Apple website indicates that "Invisible infrared light helps identify your face even when it’s dark." (https://www.apple.com/iphone-x/#face-id)

4. The parent article indicates "It uses only infrared and existing light, which means it will work in darkness without any more light than is coming off of the phone’s screen."

..that seemingly knowledgable folks can be still confused.

Bringing new tech to market isn't easy, but convincing folks that it's not a rehash of existing tech is hard too.

The new RTFM: Read The F*cking Marketing

>> I unlock it to peek at messages in meetings under the table.

> If you can look at the screen from a reasonable angle then it can see you and unlock.

You don't need to be able to see the camera to respond to messages in the bottom half of the screen. And even so, larger iPhones already allow double tapping home to bring the top of the screen down for one-handed interaction, which means you can already do everything but camera stuff (right?) with the camera obscured.

That’s a heck of a corner case, and I’ve got a secret for you - everyone else in the meeting who cares already knows you’re looking st your phone. You’re not hiding it as well as you think you are.

_You don't need to be able to see the camera to respond to messages in the bottom half of the screen._

But the camera _does_ need to see you in order to unlock in this case. You can't read or reply to a message without unlocking first.

This is wrong. You can easily read messages and reply to them from the lockscreen.

>Once you look at it, it will be unlocked.

I'd be impressed if this was the case. Looking at a phone <> a phone's camera being able to see your face straight-on.

Face-unlocking is not new, and it's not widely used. If they've managed some physics-defying scanners then maybe it'll be OK.

It's not new but they're doing it differeny. Craig said in the article that as long as it can see your eyes and nose (maybe mouth too?) it can see enough to unlock. You don't need to be square to the phone.

Mouth was definitely required too. One of the edge cases noted was it fails with masks on.

Read the article. The way they are doing it is new, at least for phones.

>I wish people would stop bashing this stuff 15m after it's announced in the presentation. Let's see what the security white paper says. Let's see what reviewers who have been allowed to use it say (they couldn't enroll at the event).

I don't see why it upsets you that someone doesn not like a product. Every comment does not need to be supported by a scientific study, or even be objective in any way. Your own comment is speculative.

I think it's more that the person thinks they don't like a product which they have never actually used.

I'm fine with "X says this, and Y disagrees" much more than "you're wrong for having an opinion". Also, I don't know about you, but I have disliked several products which I didn't purchase, and did not even try out. We're not all robots here ! :)

My issue is not that someone has an opinion on something they don’t own, as you said that’s perfectly reasonable because no one buys everything.

My annoyance is that people have an opinion on something that no one has used.

It’s perfectly fine to have an opinion about the Galaxy S8 without owning one. There were reviews and now there are other owners who you can look to find out how well parts of it work.

With the iPhone X we don’t even have refused to tell us if the feature works or not so complaints about it are pure conjecture.

I think it's more like... gah, now I have to drop a G because this tech is incrementally better, lets find ways so I don't have to do that.

Please note that this feature does not exist in isolation. Apple has not invented face unlock - nor have they invented reliable face unlock. You can unlock your Lumia 950 and Galaxy Note 8 (or 7 if you still have one) reliably with your face and it's just not as convenient or quick as using your finger because face unlock fundamentally is not as convenient as the fingerprint in my opinion.

> I don't see why it upsets you that someone doesn not like a product.

Those poor objects, won't someone think of the objects?

People are entitled to their opinions, my issue is that right now no ones opinions are based on anything other than marketing and preconceive notions. And that means that some of these deep discussion threads about whether a feature works correctly or not aren’t productive in any way. But that’s not stopping anyone from bashing things.

I'm not sure you fully understand my post. Again, I'm totally willing to go along with Apple's story for a 100% in the way it works. But they're pretty clear in their presentation and marketing that you have to 1) look at your phone and 2) slide to unlock it with your finger.

But this is much slower and are far less flexible than picking your phone out of your pocket, or from anywhere else, with your finger on the sensor. And nobody is mentioning that this is a downgrade.

You see, FaceID is not 100% new. Face unlock existed on the Galaxy Nexus. It also existed in much improved form on the Lumia 950 and Galaxy Note 7. I will 100% grant you that FaceID will be far more accurate still than these implementations. But accuracy is not the issue here: all these methods imply a two step face unlocking ritual, which again is a downgrade over no ritual with a fingerprint scanner.

In the end it seems pretty clear to me that face unlock - in any form - will be far less seamless than finger unlock. It makes your phone slightly less easy to use. Yet Apple seems to be successfully arguing that it's an upgrade or at least an equivalent. But it just can't be, no matter how good their implementation is. That's what I don't get.

1. You've never used the device so making statements like "this is much slower" is pointless conjecture.

2. FaceID is completely different to the Nexus which is based solely on 2D image recognition and is easily able to be forged and doesn't work in low light conditions.

3. From what Craig said in the Daring Fireball interview it will actually be much faster than TouchID since the authentication apparently happens in parallel to the unlock operation.

I'm not sure why I get this response. You seem to imply I have issue with the quality of Apple's next gen implementation, which I have twice explained I don't. Or you imply that I can't have an opinion on the concept of and hassle involved with face unlocking in general, which (as I also already explained) has been around for years and Apple clearly has not made any conceptual changes to.

Let me clarify for the third time. My opinion is the following: no face unlock mechanism can be as good as a fingerprint unlock for the flexibility and speed of use as explained above. FaceID will likely be far and away the best face unlock method we've ever seen but it's still a face unlock method and therefore slower and more restrictive than a fingerprint unlock. What I don't get is that nobody else is talking about it, because Apple has successfully spun the discussion to be about the quality of FaceID as opposed to the (lack of) merits for face unlocking on smartphones.

I'd actually be excited to have face unlock on laptops and PCs (actually that exists already as Windows Hello, but dedicated hardware would be nice). But on phones I consider it to be inferior to fingerprints conceptually.

Seems you have a failure of imagination. I'll try:

When did you last unlock your phone without subsequently looking at it?

Seems to me FaceID removes the need to first unlock, then use phone. New way is: just use phone. So I expect FaceID to be faster to use.

Face ID requires looking at the phone, and then swiping up. The swipe is what takes the extra time. It means that your phone is not ready to use by the time you look at it.

Touch ID lets you do the touch before you look at the phone. The phone unlocks while you take it out of your pocket, so by the time you look at it, it's already unlocked.

You have to fumble about for the home button and do an extra click for Touch ID - it's not much different, except it requires less precision/friction on the part of the user for Face ID presumably.

Face ID should also significantly improve the UX around all interactions that used Touch ID prior (Apple Pay, authentication for third party apps, etc.).

This whole conversation is stupid since none of use have even tried the thing.

> When did you last unlock your phone without subsequently looking at it?

I unlock my phone and then not look at it when making phone payments (Apple Pay will definitely take a step back with this). I also switch between maps and driving apps in the car while keeping my eyes on the road. I often peek at something on my screen well outside of the FOV of any front camera. My use of my unlocked phone is not at all limited to things I need to take my face's positioning in account for.

I don't particularly appreciate being accused of a failure of imagination and then having to respond to an arbitrary limited assumption of my smartphone use. It's not my imagination that's the problem here.

But the point is moot. My entire issue with it that I don't want to wait to initiate unlocking once it's in front of my face. Even if FaceID is instant, and I would accept that all my use is in the FOV of the front camera, Apple still requires me to slide to unlock the device.

you don't have to "look at it" -- as long as there's line of sight it should work. I pretty much agree with your position though, just wanted to clarify that as long as the infrared scanner can find your eyes/nose you're good to go. Another commenter pointed out that you need to swipe, which supports your point that it's slower than touch ID. maybe I'm getting pulled in by the Cook RDF, but I'm cautiously optimistic.

Of you don't particularly appreciate it do you? I didn't know - terribly sorry.

He's primarily asking how FaceID is less secure - a point you bought up multiple times in your original post and provided no reasoning for.

No, I brought it up once in my original post as minor compromise in security. As other have pointed out, it might be less secure as you could be more easily be manipulated to unlock your device by accident. It's a minor thing.

Wait until it's been out in the wild for a while. I've heard that Apple employees say going back to an old device after using one with Face ID feels weird... because Face ID is just so seamless, you never have to think about it, it basically just feels like your phone is always unlocked.

But it’s the same exact ritual as TouchID. Both unlock your phone as soon as you complete the necessary action (placing your finger on the center, showing the phone your face).

That doesn’t dismiss the lock screen, to do that you either have to press the home button or swipe up.

There is no new third step.

That's because you're still thinking about unlocking, then using your phone. What you're describing is the ease of the unlock step BEFORE using your phone. The big change for me with TouchID is that now, my first thought isn't unlocking the phone. I put my thumb on the home button to USE my phone, not to UNLOCK my phone so I can use it.

My guess is FaceID will be the same. You WILL be looking at the phone because you look at the phone to USE it. When you do, it will be unlocked fast enough that you don't think about unlocking (you see the screen transition, but your thoughts will be on using the phone not on the unlock that already happened).

Well, one use case I have is my phone sits on my desk arms reach away. I can lay my index finger on the touch id and check if I have a message. I don't have to lift my phone to use it.

Not saying I can't adjust my behavior. We all have our own way of using our devices.

This makes no sense.

How can you use your phone without looking at it ?

Because from what Apple has said if you can see the screen the camera will at most angles be able to authenticate you.

Lay your phone on a table about 6 inches right of your shoulder. It's perfectly possible and easy to read and use your phone this way, but your face is completely out of the camera's field of view.

FWIW I can never get TouchID to work when imm running and my hands are sweaty and the phone is covered in sweat too. Typing my pin is even harder because half my taps don’t register.

In those situations FaceID would be perfect.

That would help with the unlock step, but then how do you interact with the phone? The touchscreen wont work well as you've said putting in the pin isn't easy.

Yeah, but doing 4 taps to change playlists or go from podcast to audiobook is a loooot easier than 4 taps + 6 tap pin + failing to touchid so you get the pin input.

I'm surprised to see so many people saying they will miss TouchID. I still find the idea ridiculous compared to a much more secure PIN.

But I'm still using a Galaxy S3 so I'm not in the target demographic for sexy new phones.

https://www.forbes.com/sites/josephsteinberg/2015/03/05/why-...

> much more secure PIN

Is it? Before touch sensors became the norm people would put in their PIN every few minutes. It would get picked up by countless security cameras. You could talk to a stranger for 2 minutes and pick up their PIN if you didn't avert your eyes.

And most people didn't use a PIN at all, because it was too much bother.

A PIN isn't perfectly secure; someone can watch you enter it with a security camera or can tell which buttons you pressed from the finger impressions on the screen.

Yes, the PIN is the least secure way of unlocking a phone, by a wide margin.

If someone can shoulder surf while I unlock my phone with a PIN, then they can watch which buttons I press and now they can unlock my phone too. If I use the fingerprint reader to unlock, then they have no chance.

And a complex 40+ character password is much more secure than a 4-6 number pin. There is always a trade off, I personally don't want to press 7 times on my screen everytime I want to use it.

I have a PIN that's longer than 6 digits, and it's just ingrained in muscle memory after a short time. It's not a big difference to a shorter PIN for me.

What makes TouchID secure is not the fingerprint reader, it's the "Secure Enclave"--a dedicated computing environment for storing secrets that is separated from the main processing system.

Even if you never use the fingerprint reader, an iPhone with TouchID is still more secure than your Galaxy because the PIN is stored in the Secure Enclave.

TouchID is more conventient than a PIN, and it's no less secure because the fingerprint hash is also stored in the SE chip.

To be fair, Some androids have a similar feature, the comments on this HN question are enlightening.

https://news.ycombinator.com/item?id=13957797

To be even more fair: all Android phones you can buy today have a 'secure enclave'. It's been a recommended feature for Google Play certification since Android 5.0, mandatory since 6.0, and part of all Qualcomm, Mediatek, Huawei and Samsung SoCs for years. In your Android phone's settings, go to Lock screen & security, and look at "Credential storage". Unless your phone is ancient, you will see that the storage type is hardware-backed. My Nexus 4 from 2012 has it.

This is another one of those things where Apple marketing fares much better than their competitors :)

And why i regard Apple a marketing company dabbling on consumer electronics.

Pin and an actual keypad beats all the rest.

But then i am getting old...

I do agree that FaceID is a bit less convenient than TouchID - the "unlock while taking out of pocket" is a good example.

I also agree that FaceID might be easier to "socially engineer" or obtain by force in the sense that you could just point it at someone's face or trick them into looking at it. Less so with someone's thumb on the home button.

At the end of the day though, I think these concerns are overstated. No modern security method can guarantee 100% protection - you can watch someone input their PIN, steal their phone and force their face into it, or force someone to put their thumb on it. The last one is the most secure in this sense, for sure, but I'm of the opinion that if you've gotten yourself into one of these situations, this is far from your security bottleneck in the first place.

Someone will inevitably bring up the point of law enforcement / 4th amendment breaches, but there are safeguards with the new iPhone X that circumvent these issues.

And of course, you can always decide to just use a PIN and nothing else :)

> I unlock it while lying on the table when it's facing the ceiling.

Well, you can't actually have it lying flat on the table because the camera sticks out in the back :D

Actually FaceID will make it faster to get into your phone. Today if you swipe on a notification, you get prompted to authenticate your fingerprint. Now that step is gone -- you just go straight in.

As for opening the home screen, I think your worries are misplaced. You have to look at your phone in order to use it, and FaceID is instantaneous and works at sharp angles, so there's no need to unlock it ahead of time. All it does is replace the button press with a swipe.

The early reports are that it doesn't feel like a ritual at all. It's more like it just makes the whole authentication step go away.[1]

[1] "you get used to not thinking about it very quickly, and when you go back to a Touch ID device, it feels broken that you have to touch the button to unlock the device." https://daringfireball.net/2017/09/iphone_x_event_thoughts_a...

Valid to want to use a finger instead of face, which is a matter of preference, but reminds me of the dust up over removing headset jacks.

In the end apple will lead people will follow. Clearly they see face id as the way of the future my money is on apple getting their way.

Also when I'm in a pitch-black room, will it shoot bright light on my face to do the ID?

It's infrared. You can't see it in reality. Just marketing CGI.

Oh I see -- it was mentioned in the interview.

How about using it in a room with over 100F temperature. Hopefully nobody endures that sort of conditions on a regular basis anymore, use the fallback mechanisms for those situations. Except cars of course -- those without AC.

> Hopefully nobody endures [over 38°C] on a regular basis anymore

I've heard that people go outside occasionally. Don't know, why, either. :)

Strange folks out there :)