Hacker News Reader

Comment by chmod775 | Hacker News Reader

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over.

These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on.

This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways).

*roughly the same level of 'security' a "beware fluffy the furry menace" sign on your garden fence provides.

View on HN

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it.

It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Windows Hello exists before Apple's Face ID. 2 years before Apple.

That doesn't really mean anything. It's just another data point about how microsoft rushes out features which are not secure. Android also had face unlock years ago with the nexus 7 and it was even less secure than the current systems.

Very few companies actually care about security over flashy marketing features.

That's not really relevant to the issue at hand though

Can you explain why Apple's implementation is semi secure and others' implementations aren't? All of them have been bypassed at one point or another IIRC but that's probably not what you mean?

(also: if it's semi secure then being able to build trust based on that means the other part is PR I guess, outrageous as well?)

A few thoughts:

Apple's Face ID takes a 2-dimensional infrared image of your face as well as projects 30,000 IR dots to form a 3D depth map of the face. It feeds this into a NN in a separate Secure Enclave processor to determine whether the face is attentive and authorised. I believe they also implement specific NNs just to perform anti-spoofing, both physical and digital.

This is contrasted to Samsung and Microsoft's solutions which take a picture and try to match it.

Apple's Platform Security Guide on Face & Touch ID [0] is an interesting read.

[0]: https://support.apple.com/en-gb/guide/security/sec067eb0c9e/...

Microsoft's solution requires an (near) infrared camera and will not accept a regular USB camera, though. But it does seem to rely on simple facial recognition rather than building a depth map. The main use of the near infrared seems to be to work around lighting issues and simple spoofing though.

https://docs.microsoft.com/en-us/windows-hardware/design/dev...

iPhone X(box Kinect)

Still nowhere near as secure as they make out though

What vulnerabilities are you referring to?

If you have relatives that look like you the chance goes down from one in a million. And they're also the most likely people to have access to your phone, and by interested in what's on it.

Also the younger you are the less likely it is to differentiate.

Windows Hello does require an IR camera AFAIKA, so a "basic webcam" is not enough. However, it's not clear if this exploit would still work if the custom USB device presented a moving IR video as opposed to a static image.

Maybe it's just completely outrageous that people still think Microsoft or Samsung care about them in any way?

Facial and fingerprint authentication is the most successful and practical security feature protecting billions of computers which would have been unprotected otherwise. It should not be dismissed like that, and I’m glad the work is being done to find and fix vulnerabilities.

>successful and practical

In marketing sense. You leave your fingerprints all over the keyboard, and I can record your face freely.

And it compromises equally as much by providing a false sense of security

I can think of many major security breaches related to poor or leaked passwords and honestly none come to mind with faked biometrics. Not to say that there aren't any, but passwords have a terrible security history and everyone should be glad that they're slowly becoming just another factor rather than the sole gatekeeper.

Biometrics should equate usernames, not passwords

Reply on news.ycombinator.com