Hacker News Reader

Comment by ASalazarMX | Hacker News Reader

> What exactly is the reason/rationale that it has to fail on facial recognition first before proceeding to use passcode?

C O U R A G E

Joke aside, it seems that Face ID was a tremendous technical effort so you could have instant access to your phone. Besides unlocking, there's no other serious application (memojis aside). The fingerprint reader was probably removed just to prop acceptance of Face ID. Also, Face ID is less secure. If you're detained or mugged, just looking at your phone will unlock it before you can react and look away.

IMO, the 3D scanner should be on the other side, enhancing your pictures with 3D depth.

View on HN

If you're detained or mugged you have other problems to worry about. They can also threaten you with a knife to get your pin code or put your fingerprints on the phone. If anything face ID requires your eyes to be open, they can knock you out and use your fingerprints more easily.

Law enforcement in most developed countries won't resort to violence to get your credentials but are happy to point your phone at your face.

By the "they can just use violence" logic, no computer is secure and we should throw them all into the ocean. Security can improve the intermediate cases- focusing solely on the worst case is unproductive.

They can also enforce you to use your fingerprint or face (in The Netherlands) but not PIN or password (in The Netherlands), both with proper (minimal) force. In UK, there's a law to force a user to give away their password. Which, IMO, is the same as being enforced to help your own conviction.

I always preferred the fingerprint sensor over Face ID. You can unlock the phone before even taking it out of the pocket. At my desk, I can unlock the phone without leaning forward so it sees me. The only time that Face ID works (better) is when it's freezing cold and you don't want to take your gloves off to unlock the phone.

If you’re detained or mugged hold both the power and a volume button for 3 seconds.

Hard to do when you're busy getting mugged.

You should set lockdown mode (enforce PIN/password authentication) before getting mugged. I don't know it's possible on iPhone, but possible on Android.

Press the power button 5 times quickly. Warning: LOUD.

except I was trying to use my phone to record being illegally detained

> If you're detained or mugged, just looking at your phone will unlock it before you can react and look away.

As far as hypothetical situations go, I prefer this over them cutting off my finger.

More seriously, in a situation where I'm detained or mugged, there will be a lot of external factors which are pushing me to unlock my phone, be it via passcode or biometrics.

FWIW, "SOS mode" (holding the power and volume up buttons) will purge information needed for biometrics to work and mandate a PIN on both TouchID and FaceID devices.

Most fingerprint (and other biometric devices) sensors do liveness checks

That expects all the muggers to know this fact and would avoid cutting fingers.

> IMO, the 3D scanner should be on the other side, enhancing your pictures with 3D depth.

That's what the LIDAR sensor on the latest phones is for. It only gets used in photos for the portrait-mode stuff, admittedly.

Off topic, and I know we're in the middle of an Apple-bashing thread, but the portrait mode on iPhone 12 is amazing.

Portrait mode is Apple-speak for pseudo-depth-of-field, which is the effect that real cameras do that make the subject in focus but the background blurry.

It makes photos look way more professional.

FaceID used 3D depth in perception, it’s not camera what it uses.

> Also, Face ID is less secure. If you're detained or mugged, just looking at your phone will unlock it before you can react and look away

Much easier to force someone to unlock the phone with their fingerprint than to force them to unlock with faceid if you have “Require attention” on.

You can’t physically force someone to look in a certain direction, but you definitely can force them to tap their finger on a surface.

Long passcodes are still better.

You can't make a general assertion like that because “better” depends on different factors:

* If you're concerned about someone who can see you typing, a biometric is better because they have far fewer chances to watch you — especially if you don't reboot outside of your home.

* If you're concerned about actual adoption, a biometric is better because you remove the constant frictional password entry cost which causes a large fraction of users to use short, easily-entered passwords.

* If you're concerned about someone who has enough access to construct a usable fingerprint / face facsimile but can't coerce you into providing a password or shoulder-surf it with a drone, a long password is better.

> You can’t physically force someone to look in a certain direction

Excuse me, but this is ridiculously easier than forcing someone to use their fingerprint; just wait until they are distracted, show them the phone and ask them "what is this?". It unlocks in less than a second with "Require Attention" activated. We prank each other this way when we forget our phones around the house.

We're not talking about pranks, we're talking about someone getting robbed. It will be pretty hard for the robber to "distract you" and spring the phone on you.

Reply on news.ycombinator.com