Face ID flop: Chinese colleagues can both authenticate iPhone X
pocketnow.com
pocketnow.com
I even think that AI investments are going to be a major cause of the next stock market crash.
Automatic re-train is a "feature" you cannot turn off, cannot turn on, have no visual feedback that it occurs, and ultimately weakens the security of your device.
If this is what is causing Face Unlock to fail then that's still just as much Apple's responsibility than any other methodology. You also have no way to knowing how much re-train has occurred since Apple doesn't provide that information.
If you give your passcode to someone with extremely similar facial features, you should expect that they'll be able to unlock your phone.
https://support.apple.com/en-us/HT208108
To disable Face ID, open Settings > Face ID & Passcode, and tap Reset Face ID. Doing so will delete Face ID data, including mathematical representations of your face, from your device. If you choose to erase or reset your device using Find My iPhone or erasing all content and settings, all Face ID data will be deleted.
It doesn't bother me that she can unlock my phone, but I bet the facial model my phone has for "my" features is a weird hybrid.
Not arguing this is ideal, but it works and avoids retrains, although Apple have publicly stated retrains only occur if they believe the face matches above a base threshold, which makes it much less likely a female face will retrain on a male Face ID user’s phone, and vice versa. It doesn’t retrain on every passcode entry.
https://images.apple.com/business/docs/FaceID_Security_Guide...
It is pretty common for spouses to have a finger added on their spouse’s phone for unlocking it with Touch ID, e.g., when you’re driving and get a message, you can give it to your spouse who can reply.
Many parents also have a finger added on their young children’s phones.
None if these scenarios are really possible with Face ID, because you’ll end up training Face ID with two faces. And while phones are usually used by only a single person, it is not an uncommon scenario to have a secondary user.
Anyway, if you want to have a shared phone like this, get one that has Touch ID. Apple offers both.
Or trust that Apple does this intelligently and doesn't train the facial recognition in this case when the face is too far out of bounds. As other commenters mentioned, I'm pretty sure that's how it works. It's not training based on your wife's face unless she looks a lot like you. And in that case, you want her to be able to unlock your phone, so isn't it a good thing?
And if you are one of those couples that look alike enough to be able to train the phone, why do you care? You already gave your spouse full access via your passcode.
She can change the music on my phone while driving, look up stuff for me to enter into maps, and do everything else with it.
This would certainly make some edge cases (for example if you didn't use your phone for a while => changed facial features) less "magic" because you would always have to enter the passcode - but a simple "retrain" should then solve the problem... am I correct?
I feel Apple should let your train the FaceID a bit more so that it is more correct, or maybe a setting on how precise the match should be, as this is a clear example of where the Face detection is too loose to ease the user compared to the lower security.
It would probably be even easier to find matches if we knew the precise heuristics Apple employs for ignoring glasses, headwear, facial hair, and so on; to be at all practical the feature must have generous degrees of freedom, which in turn reduce discrimination.
Finally, as many have observed, there are plenty of situations where humans will be in close physical and social proximity to others with similar faces: twins, siblings, etc.
Even if collisions are as infrequent as Apple claims (which I find dubious), face identification is fundamentally a lock that is easier to "pick" than fingerprints. I am forced to conclude that depending on facial recognition is a poor engineering decision motivated by user convenience whose limitations are deliberately mischaracterized by marketing materials.
Both technologies are fairly secure against run-of-the-mill thieves. They’re good enough that the market for stolen phones is probably reduced to breaking them down and selling them for spare parts.
If you happen to fall victim to a more sophisticated criminal, Touch ID is going to be way worse. Your phone is covered with the fingerprints needed to unlock it. It will take some sophistication to turn a print into something that can unlock the phone, but it’s doable.
There’s no equivalent for Face ID. Most likely the criminal doesn’t know what you look like at all, so they could try five random people and then get locked out with a probability of success of roughly 1 in 200,000. If they know who you are they could try to look you up and find similar looking people, but that’s going to take time and effort and you have to get it done within 48 hours, and the odds of success are still not great. (If it was easy to reliably unlock the phone with a similar-looking person, we would have heard a hundred stories like this by now.)
It’s far from perfect but I have no qualms trusting my security to it. It’s better than Touch ID and far better than the 0000 passcode I used before that.
As far as I am aware there is no reason to believe siblings or relatives should have similar fingerprints. On the other hand relatives are more likely to have similar facial features.
So for the people who have regular access to your phone, there is no reason to believe the fingerprints should be similar. There is reason to believe their appearances would be.
In any case, I’m not trying to defend against my brother, I’m trying to defend against a random thief. They probably won’t look too much like me.
On the other hand, fingerprints don't suffer from that effect, as they're unaffected by genetic diversity.
If the technology is bad and dangerous, stop buying it. Publicly and loudly discourage people from buying it. Go to the media, drum up hysteria about the dangers of FaceID. Bury the technology under public skepticism. Convince people that biometrics are dangerous and put them at much greater risk than before, and send a clear message to the industry when biometric sales tank.
Anything else is hypocrisy.
As an individual, I do what you suggest. The problem happens when it's imposed on you. Since most people couldn't care less about privacy, surveillance, and continuous data collection, the result is this:
- You don't want to give your biometrics for a driver's license or passport? Fine, but you won't be allowed to drive or travel. Or open a bank account or work or get social services.
- You don't want to enroll your fingerprints (or palm/retina/iris) for the locks and access cards at your new job. OK, but don't come back to work tomorrow.
- Soon, 3-5 years from now, when every smartphone uses facial recognition and it is mandatory, then what? Stick with your older smartphone? It won't run any future apps and won't have access to whatever new communication technologies that emerge.
You're giving constructive advice -- which is great. But it's not that easy when most people don't give a hoot about privacy and data collection, and it's very difficult to convince them otherwise.
Or buy one if you want one and use an alphanumeric passcode if you don't like biometrics.
And if for some reason they do, change platforms then.
Long ago, no one thought mobiles and laptops would not have removable batteries either.
The idea Apple would remove passcodes is a paranoid fantasy on par with them removing the touch screen to force you to use Siri.
95%+ of these cases where a very similar face can open the phone is because they trained the iphone to recognize both faces. Caused by very similar looking family members sharing passcodes, each failed attempt adds the face to the model. If you don’t want your very similar brother to access your iphone X, the fix is simple, dint give him your passcode.
FaceID is part of making phones even more secure. Most people won’t use passcodes. TouchID can’t work with gloves, wet/sweaty fingers, etc. FaceID is much easier to setup, and displays notification details without forcing you to unlock. Whichever you prefer, either allows you to have a far more secure passcode without it being a hassle.
Have you not seen enough evidence that this is harmful?
Put this info in context: frequency of this vs correctly guessing a passcode; probability that your attacker is also the person with a similar face; that it can be disabled.
I wish Face ID were perfect too. But please don't be rash.
To be clear: face ID should authenticate you are the valid user, then prompt you for your passcode. Wrong face? No passcode challenge.
Face ID is an answer to a question no one asked. I’m sure I’d acclimate but the fingerprint reader works brilliantly.
I'm not making any comment on Face ID, but the fingerprint reader does not work brilliantly. I think it's pretty good, but it has some major shortcomings.
It works really poorly if you have moisture on your fingers (which is not uncommon for me). And on a number of occasions I've accidentally (and unknowingly) unlocked my phone while it's been in my pocket and subsequently a bunch of crazy stuff has happened (web-pages being opened, clicked through to weird places, accidental reply to an SMS etc).
Unfortunately, people rarely define their terms when talking about sensitive subjects. It'd save a lot of people a lot of stress.