Face ID Stinks [video] | Hacker News Reader

Face ID Stinks [video]

troyhunt.com

56 pointspgl61 comments

Disagree with a lot of his thoughts.

I live in Perth Western Australia, arguably more sun than the Gold Coast. Wear fully polarised sunglasses also, and it unlocks flawlessly outside.

Most of his attempts in the sun worked.

Also, he notes

> Oh - incidentally, I'm conscious that the final attempt I made in the car which failed is likely due to too many biometric fails and it wouldn't have passed under even ideal scenarios. That doesn't change all the failed attempts leading up to that, but it deserved a mention anyway.

Also mentions needing to look at the 'thing' to unlock. He could turn off the attention unlock feature to get unlock scanning without needing to look at the iPhone.

Lastly, he keeps swiping up from the middle of the phone which only brings up notifications, to get into the home screen you need to swipe from the bottom.

I hope Apple adds an option to swipe up from the middle at some point to unlock the phone, having to reach all the way down to the bottom is not comfortable with one hand.

When I'm laying in bed I can't do it one handed without tilting the phone in a direction that points the camera away from me. That's my only complaint about TouchID though.

And people who live in colder areas where there are snow and have gloves are really glad about the face id because then you dont need to take off your gloves if you need to call someone.

Gloves that work with touchscreens have been around for years.

With a fingerprint passthrough? :)

Probably meant you could enter a pass code without taking your gloves off.

Having owned quite a few pairs of these, the quality and features vary widely (including, importantly, insulation against the cold and moisture -- not to mention how well the touchscreen compatibility actually works).

Or smartphones with screens sensitive enough for use with gloves

Yes but they are so thin, in my country it can get really cold.

I don't think they are all thin, nor should they have to be - the touchscreen doesn't have to detect your skin, the gloves have a material that is detectable by the screen.

Been using my iPhone X for about 3 weeks now and 99% of the time faceID is so seemlwas I can’t believe it. The other 1% is me getting used to it. So I disagree. It’s fantastic. It does not surprise me though how clingy to old ways some people are: how they abhor change. This is apparently the future of Apple devices so we get onboard and adapt or find a platform without it - like an iPhone 8.

> This is apparently the future of Apple devices so we get onboard and adapt or find a platform without it

That's pretty much applicable to every major (lasting) change Apple has made in the history of iOS. This is just the latest, not the first.

Completely agree with your assessment. I was very skeptical about Face ID, but it's leaps and bounds better than Touch ID. I've had more failures with Touch ID than Face ID, it's not even close. The "sweaty finger" problem or it being cold and you have gloves on already makes Face ID a lot more useful.

I've been outside, with a beanie or baseball hat on, and sunglasses and Face ID works every single time.

*seemless. Sorry for the typo

seamless* but I knew what you meant. :)

spelling was never my forte. thanks!

Didn't watch the video so I have no idea what kind of issues the OP faces.

Wanted to explain my experience;

- I trained face id with glasses. It recognizes me 100% with glasses in any light condition.

- Without glasses, it has something like 75% success rate but I feel like it's getting better. Is it learning?

- The thing is actually pretty fast, I just take my phone out and swipe up. 1/10 times I see the face id screen momentarily, otherwise it just goes straight to home screen.

- My only issue is when I want to check something in bed, maybe phone does not look directly at my face etc. Then I need to enter the pin.

I would not say it stinks, again, I don't know the complaints in video. I think it's better than Touch ID because that used to require multiple actions to see notification details from lock screen etc. Face ID solves that problem.

Oh just one thing; my wife put her phone in front of my face the other day saying "look at this!" all excited. Thought I was looking at a video or something but it was locked. Turns out it was my phone, she just had it unlocked and went away with the phone. So, there's that.

not being able to unlock the phone while in bed using faceid is very inconvenient. not only does faceid not succeed most of the time but i also have to wait until the attempt times out to enter in my passphrase. overall i think faceid > touchid but in some situations (like the bed scenario) i'd like touchid to be available. when i got my iphone 5 i was super happy to see that i could reach over to my bedside table and the phone would be unlocked before i got it in front of my face.

If faceId fails i just press the home button twice and try faceId a second time. Never failed me.

what home button

I reckon you're learning, not it. You'll have picked up on the various factors that increase the P(unlock): orientation, facial expression, etc.

> My only issue is when I want to check something in bed, maybe phone does not look directly at my face etc.

A face actually looks different when under different gravitational pull. Try making a photo of yourself while in bed, then look at it in upright position. Your face will look sagged, fatter, and/or asymmetric.

Serious question: it looks like the system is training to recognize your face. But is there any way of knowing the false positive rate after the training?

By glasses do you mean clear lenses?

Clear but has UV filters. What kind of light does the dot projector use? Maybe it sees the glasses as a wall.

Face ID has been much better for me than Touch ID was. If I was sweaty, had just washed my hands, eaten greasy food, or my hands weren't perfectly dry then Touch ID would fail.

When I got my iPhone X I had a big huge beard. I shaved it off and I was expecting to have to retrain Face ID. Nope, it just worked immediately. It fails sometimes, but not nearly as often as Touch ID did.

Blog snippet links to a 26 minute Youtube video, where Troy describes (in a rambling, conversational way) the difficulties he's experienced in unlocking his phone with Face ID.

I am surprised you made it through a 26 min video with nothing but predictable content. Kudos to you. I didn't.

1.5x speed, frequent jumps forward by a minute or 3. This style of video has become more common on Youtube, and I fear it's a trend to increase duration and thus increase revenue, at the cost of "content density".

I was expecting one sentence explanation, not 26min of vídeo

Congrats, you just have wasted 26 minutes of your life.

I thought Troy Hunt knew how to write?

Yep. tl;dw

tl;dr It just doesn't work all that well in many common situations.

Glare from sun off sunglasses makes it fail. The phone needs to be pointed right at you, no opening it just pushing the home button. Can't be sitting flat on the desk. There are many times when you don't want to pick it up and point it at your face. Faceid makes you loses the tacticle feeling, no information feedback to you. Unlocks too often, like you just want to see what time it is. Pushing a button is an explicit action, you are telling it to unlock now. If you have the phone in a car dashboard mount, it's tough to unlock, you need to move. It needs to in general be pointed right at your face to work. He's not sure if he'd buy another phone with faceid, though admits the next generation should be better. At the moment it has too many problems.

"Require Attention" solves some of these issues, but then that weakens the security.

He asks a question, is faceid for usability or security? Did Apple design it to make things more usable or more secure? Is it there because it's better, or just because they removed the home button?

Great questions! Previously I never had to use my passcode as much as i do now i have the x as i do now. It’s totally absurd and frustrating, finger print was for me a superior experience.

I have the exact opposite milage. I was typing my password a lot with touchID. Now I made my pass longer and I need to type it only like once every week.

> Can't be sitting flat on the desk.

Just tested this and it works fine. I tap the screen, move my face vaguely into the camera's view, and it unlocks.

> Unlocks too often, like you just want to see what time it is.

If I tap the screen or "raise to wake", it unlocks, sure, but -nothing else happens-. I still have the time and notifications right there. You have to swipe up to get to the home screen.

> It needs to in general be pointed right at your face to work.

Not in my experience. It has to be able to see your face but that seems to be a pretty wide FOV.

> Glare from sun off sunglasses makes it fail.

Haven't experienced this but it's winter in the UK and I've only had sunglasses on a couple of times (although I'd argue that the low sun would make it more likely to create glare for the phone...)

I'm not entirely sure this video is accurate.

Does a photo work?

its just weird all of this has solutions that were found a month ago!

if you want your face id to unlock while sitting flat on a desk, then teach your device that angle of your face when you first set up face id!

"I didn't google this at all so I'm going to masquerade this as canonical"

Face ID works miraculously for me. I was very surprised. My 6S Plus's Touch ID, for me, didn't work quite well. It worked 70% of the time and I had to type my passcode the rest of the time. I think Face ID failed once in the last five days, since I got the device. Again emphasis on the 'for me' part. I don't know if this reflects the whole, but Face ID is significantly better compared to Touch ID.

with regards to face id / touch id, I would love to be able to set layers of protection on my device. So that face/touch would only unlock higher level portions of the device but still require a password to get to my data, my email. A config screen similar to notification allowances but instead denotes which level of security is required to access. Another example would be securing my recent calls list.

Sounds like a use case for multiple user accounts. That would certainly be nice. Even nicer would be the ability to globally blacklist permissions for each account.

For example I’d love to have a separate account for all my banking apps, with a separate passcode and a locked down set of APIs.

This will never happen though, because app sandboxing is good enough.

> Sounds like a use case for multiple user accounts.

I don't think that's the use case here. OP is asking for the ability to lock a single user's sensitive data behind a second layer of security. I interpret this as similar to "with a password I can see my bank account's history, but when I attempt a transaction I'm prompted for 2FA."

Honestly i've been annoyed since touchid came out that i couldn't set some things to 2FA, as in pin+biometric

Face ID is fantastic. It works more reliably than Touch ID did for me. Security wise, maybe not as secure. But more convenient? Absolutely.

He was for FaceId in the abstract, but finds it doesn't work well in the concrete. But you can trust him, because he loves Apple kit.

Additional anecdata note: I was against FaceId in the abstract, but find it works incredibly well in the concrete. My early skepticism has disappeared completely.

I mean, I'm not saying he doesn't have issues with sunglasses and pool water reflection, but even trying to demonstrate the issue in a video it seemed to work a lot more often than he expected. I mean, he seemed to be surprised when it worked with "sunnies" and a hat repeatedly. I dunno.

I've definitely found FaceID to be much, much useful than TouchID was. I suspect that will be true for most people.

P.S. I know this is a video demonstrating the issue, but I wonder how much of his issue is caused by thinking of unlocking as a completely separate step. I just pretend my phone has no lock, and tap and swipe as needed.

It must be mentioned, biometrics are not suitable as a password. They could replace a username. But passwords must be changeable, not left out in plain sight all the time, and relatively unguessable. Biometrics fail on all counts.

Biometrics also cannot be used to produce cryptographic keys, meaning that all depend on that last conditional jump not being circumvented.

Face ID is by far my favorite feature of my iPhone X. I was expecting the camera to be the number one feature. Don’t get me wrong, camera is fantastic. As good as I expected and then some. But Face ID just blew me away. I was always having issues with Touch ID. Whenever I have sweaty hands, or sometimes just randomly it would fail. Since iPhone X I almost never have to actually enter the lock code. It just works. And in rare cases it fails it works on the second try when I retry it “properly”, fixing the usually obvious reason it failed, e.g. not facing it right etc.

I have a Oneplus 5T. Face recognition works fine most of the time, I use the finger scanner only when in the car, or some other unusual setting. Best of both worlds

Kind of funny anecdote: My ~30 year old female Filipino coworker's phone unlocked when she pointed it at another ~50s male Filipino coworker's face.

I don't live in a beautiful place like sunny Australia, but I do live with sensitive eyes and wear sunglasses often. Probably 300 days a year (tongue-in-cheek from quote in video). Also have the annoying habit of sneezing when it's too bright, so I'll wear sunglasses into and out of buildings.

I was going to go for the iPhone X, but hearing that sunglasses often impede the unlocking process, I suppose I'll have to stick with the fingerprint scanner. Bummer, was very excited for this.

For what it's worth, i've tried it with 6 or so pairs of sunglasses and have yet to have it fail. Including mirrored ones, and fancy polarized higher end ones

For what it's worth, my experience has been nothing like what this guy described. I live in Colorado, which is a fairly sunny place, and I've had no issues. I've used Face ID with polarized (Oakley) sunglasses, with a beanie on, with a baseball hat on, and it works flawlessly both inside and out (even on the mountains in an open field on a 100% sunny day).

I had far more failures with Touch ID, mainly due to slightly sweaty fingers. Or failures after washing hands. Failures if you have greasy hands. Not to mention if you live in a cold area where you use gloves in the winter, Face ID is dramatically better than Touch ID now.

My mirrored Ray Bans foiled FaceID ever time. It adds friction for Apple Pay too. TouchID personally worked much better for me.

Is it all we have to worry about ?

[video]

Face ID will become an increasingly bigger risk with every store you go into starting to deploy advanced face recognition (and then those databases will be breached by hackers).

Apple should put Touch ID on the back of the iPhone and call it a day. It doesn't even have to "go back" on iPhone X, just do it for the next iPhone 9 or whatever it will be called. See if people actually prefer the fingerprint reader on the back and no-silly-notch iPhone over iPhone X.

The stores would have to deploy special-purpose IR cameras to collect the kind of data FaceID uses. And even with that data it’s unclear how it could be used to present a false image to a phone. The hacker pulling this off would also need physical access to your phone.

From a security perspective it would be a lot easier to collect a fingerprint and use known methods to create a false fingerprint that a phone would recognize.

So if you’re worried about this kind of thing, FaceID is preferable.

Also, if they were able to figure out how to install that face map onto the secure enclave on your phone, it would likely have to be turned off and back on and then they would need to enter their passcode on boot before Face ID would work.

This seems like apple fixed something that wasn't broken. The cynic in me suspects that long term Face-ID it is less about security and more about giving Apple/Advertisers insights into what we look at (specifically on a page) and how we emotionally react to content, in order to sell us more stuff.

Reply on news.ycombinator.com