Hacker News Reader

Comment by SilverRed | Hacker News Reader

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it.

It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

View on HN

Windows Hello exists before Apple's Face ID. 2 years before Apple.

That's not really relevant to the issue at hand though

That doesn't really mean anything. It's just another data point about how microsoft rushes out features which are not secure. Android also had face unlock years ago with the nexus 7 and it was even less secure than the current systems.

Very few companies actually care about security over flashy marketing features.

Can you explain why Apple's implementation is semi secure and others' implementations aren't? All of them have been bypassed at one point or another IIRC but that's probably not what you mean?

(also: if it's semi secure then being able to build trust based on that means the other part is PR I guess, outrageous as well?)

A few thoughts:

Apple's Face ID takes a 2-dimensional infrared image of your face as well as projects 30,000 IR dots to form a 3D depth map of the face. It feeds this into a NN in a separate Secure Enclave processor to determine whether the face is attentive and authorised. I believe they also implement specific NNs just to perform anti-spoofing, both physical and digital.

This is contrasted to Samsung and Microsoft's solutions which take a picture and try to match it.

Apple's Platform Security Guide on Face & Touch ID [0] is an interesting read.

[0]: https://support.apple.com/en-gb/guide/security/sec067eb0c9e/...

iPhone X(box Kinect)

Still nowhere near as secure as they make out though

What vulnerabilities are you referring to?

If you have relatives that look like you the chance goes down from one in a million. And they're also the most likely people to have access to your phone, and by interested in what's on it.

Also the younger you are the less likely it is to differentiate.

Microsoft's solution requires an (near) infrared camera and will not accept a regular USB camera, though. But it does seem to rely on simple facial recognition rather than building a depth map. The main use of the near infrared seems to be to work around lighting issues and simple spoofing though.

https://docs.microsoft.com/en-us/windows-hardware/design/dev...

Windows Hello does require an IR camera AFAIKA, so a "basic webcam" is not enough. However, it's not clear if this exploit would still work if the custom USB device presented a moving IR video as opposed to a static image.

Maybe it's just completely outrageous that people still think Microsoft or Samsung care about them in any way?

Reply on news.ycombinator.com