Hacker News Reader

Comment by hajile | Hacker News Reader

Facebook says one in a million people will match (vs one in 50k for fingerprints). I'd guess that close family generally have a better shot of being that face match compared to a complete stranger (unlike fingerprints which don't seem to have familial features).

View on HN

That’s the issue I’ve had with Apple’s claims about FaceID being X times more secure than TouchID.

Your facial features are very likely to be similar to people who live around you. I don’t believe this is true of fingerprints.

So it seems it’s far more likely that the 1 in million chance of an overlap will be around your phone than the 1 in 50000 chance in case of TouchID.

It's also far more likely that those people do not pose a genuine malicious threat to your data and security

From personal experience, close by people are far more likely to hack you than strangers. Systems should reflect this. For instance, WhatsApp Web shows a prominent notification. Signal does not. So one investigative technique is to get someone's phone for a minute, connect Signal to the desktop client, then rather silently have access to their account.

When it comes to unlocking phones, I'm far more worried about family, romantic partners, friends' kids playing pranks or trying to get a bit of cash than I am about some organized crime gang or CBP faking my face or fingerprint.

I personally wouldn't want even my close family members to have complete (read AND write!) access to my texts, emails, Facebook, etc. even though they don't pose a "genuine malicious threat", and I'd guess that's a fairly common sentiment. Privacy has merits beyond security ramifications.

I think parents who have had their kids purchase things from the app store without their approval might disagree.

Does FaceID recognize children as their parents?

Only if the parents have given their child the PIN and they also look similar enough to trigger against the existing facial model.

Alongside claims Apple specifically talks about people with close genetic makeup and twins: https://youtu.be/eRvBU_tKGjE at 12:12

>>>Your facial features are very likely to be similar to people who live around you.

Is this your assumption or do you have a reference for this?

https://en.wikipedia.org/wiki/Genetics

This link is utterly irrelevant in the context of FaceID.

I think the assumption was that the people who live around you are genetically related to you aka family. I originally read the statement as meaning geography and proximity to strangers increases the chance that they’ll look like you.

I fail to see how this is relevant to FaceID which profiles the shape of your face. Similar to our senses and similar physiology that would give the same measurement results are not the same thing.

It's also far more likely for an attacker to have your photos upon which to build the authentication profile, than it is for them to have your fingerprint.

Apple is being misleading with that number, because it assumes an attacker would throw random photos/profiles at the iPhone X, not profiles that look very similar to you, which is far more likely to happen in practice.

Reply on news.ycombinator.com