Hacker News Reader

Comment by anandchowdhary | Hacker News Reader

I love the idea, I had a similar one two years ago (https://github.com/AnandChowdhary/notes/blob/main/notes/2018...) to use “face unlock” but as an MFA method.

The one problem I had was that face detection using the webcam is not be accurate, e.g., it can be easily fooled using a printed photo of the person or changing the webcam input to use a static photo. With WebAuthn, however, this is not possible because it connects to the device’s native authentication. On macOS, for example, it’s much harder to spoof Touch ID.

How would you go about preventing such problems? Isn’t it better to provide an Auth0-style SDK to use WebAuthn with SSO, or do you think using this cloud based image recognition system is as foolproof as the native options?

View on HN

That's right, successfully preventing spoofing attacks using 2D input is an extremely hard problem to solve. We've spent two years working on it. We published a high-level overview here - https://getxix.com/learn and plan to publish a deep-dive overview of the approach in the coming weeks.

For SSO, Entry can be added as SAML 2.0 Factor today. I agree if we would not have solved the spoofing problem, taking the Auth0-style route for native platforms is the way to go.

Relevant quote from the linked overview:

> Entry addresses the spoofing issue from 2D input by using an anti-spoofing algorithm that processes a sequence of images obtained from a single camera to build an accurate 3d face reconstruction based on facial key points. Additionally, it estimates the pixel distribution of the input image to detect attacks. Aggregation of both methods achieves high accuracy for detecting attacks on face recognition systems.

thanks for posting it here. It is still too high-level. We'd be publishing in-depth details soon.

This wouldn't seem to help, unless you correlate it with motion sensing data. You can build point clouds from deep fake videos just as easily as from real videos.

What stops an attacker from spoofing the webcam with a looping video of the subject staring at a camera instead of a still image or holding up a picture?

Several layers of anti-spoofing.

They detect mask-attacks, replay attacks (put the phone with video into the camera; highjack a webcam input and send a pre-recorded video faking to be real-time from zoom for example), and, of course, still images.

Give it a try!

Wouldn’t you still be vulnerable to attack via a 3D printed or resin cast face (possibly suitably painted)?

Or just tape a print out to a balloon.

> I love the idea, I had a similar one two years ago (https://github.com/AnandChowdhary/notes/blob/main/notes/2018...) to use “face unlock” but as an MFA method.

btw, https://gazepass.com does this as well.

Reply on news.ycombinator.com