10 ms·

> Your face is now your password no, it isnt. and neither are your fingerprints. none of this publicly available data is a password. a password is something i

> Your face is now your password no, it isnt. and neither are your fingerprints. none of this publicly available data is a password. a password is something i can change if it gets compromised. a password is secure from others. biometric data is a username/id. why do companies insist on getting this shit backwards?

pwython 9y ago
"My v̶o̶i̶c̶e̶ face is my passport. Verify me." 'Sneakers' had it right. Consider it more of a "passport."
sjwright 9y ago
> biometric data is a username/id. Which is why it's called "Touch ID" and "Face ID".
- eCa 9y ago
  > Your face is now your password. That's a direct quote from the product page.
- jasonkostempski 9y ago
  Yet they behave like a password.
  - dkonofalski 9y ago
    No they don't. They behave like a username/password combination. A username is an individual identifier and a password is a confirmation that the identifier is valid for the person it's identifying. TouchID and FaceID confirm both - that it's the correct user that has access and that the user is who they say they are.
- haswell 9y ago
  It's important to note that in the context of these Apple features, "ID" is for "Identification", not some kind of "User ID" used as a Username. Username != ID.
eCa 9y ago
Agreed completely. I hope I'm never in a situation where I'm forced to use my face or fingers as a password.
nilkn 9y ago
Their job is to sell. They want everyone watching to understand exactly what they mean. For what it's worth, I would say that Face ID isn't quite a username either. Once known, anyone can reproduce a username. I can't easily recreate your face even if I know you well. That would require an extra set of skills/equipment. The same argument goes for Touch ID.
- Spooky23 9y ago
  It isn't a username or password, it's another factor, similar to how we identify people that we know. It's not perfect, which is why we have policies for accessing things. It's almost certainly a better security mechanism than a password.
audunw 9y ago
> biometric data is a username/id. > why do companies insist on getting this shit backwards? They don't have it backwards, but they're also simplifying when they say it's your password. In the presentation they actually say specifically that there's a chance that someone else can unlock your phone (1 in 50'000 for fingerprint, and supposedly 1 in 1'000'000 for Face ID, given that you don't have a twin). Reality is that it's somewhere in between. A fingerprint sensor or face reader will keep casual snoopers - and most people who find your phone on the street - out. That's all that matters for most people. It's not a username. It's at least moderately hard for someone to duplicate, and it's not something you'd actively share with someone. It's not as safe as a password, but Apple isn't trying to claim that either. I think it's a good idea to avoid false dichotomy here. Biometrics is biometrics. It should be treated as distinct from passwords or usernames.
- tentaTherapist 9y ago
  Okay, but shouldn't developers make security easy? This makes introducing a sizable hole into existing security easy, which is the opposite of what you'd want.
- aquadrop 9y ago
  Yes, touchId/faceId sits in between, it's quick access token, which is enough for 95% of the time, but those other 5% are very important.
  - jachee 9y ago
    Those other 5% might be too important to have your phone involved with them.
    - arielpts 9y ago
      Or, if one needs those 5% moments on phones, it's always a possibility (as stated on the keynote) to add password additionally.
- a_t48 9y ago
  1 in 1 000 000 is the same odds as a 6 digit PIN (though you can always change a PIN). That's acceptable to me.
electrograv 9y ago
It's not a password, but it's not a username either. It's something in between: It's vastly easier for me to type your username in the login box than it is for me to create a sophisticated prosthetic or high resolution 3D scan (with correct infrared coloration) of your face.
- mikeash 9y ago
  I wish people would stop repeating the canard that biometrics are usernames, not passwords. Biometrics are biometrics. They are different from both usernames and passwords. They have their own advantages and limitations. Learn them, understand them, and use them or not based on what they are, not some other thing they sort of seem like.
- threeseed 9y ago
  Prosthetics were specifically covered in the keynote. The neural networks have been trained to recognise them as fake faces.
  - Dylan16807 9y ago
    They're not magic. You can make a fake with enough effort. But it's a lot of effort.
  - jomido 9y ago
    http://www.evolvingai.org/fooling http://www.evolvingai.org/fooling
  - briandear 9y ago
    The weird thing to me is that apparently we have so many people on HN that consider themselves worth the effort to make full 3D renderings of their faces just to unlock a phone. Unless you were Osama Bin Laden, it seems highly unlikely anyone would go to the trouble. If you are that kind of person, you’re probably going to be protecting your information with much more than Face ID.
    - SturgeonsLaw 9y ago
amaks 9y ago
Not entirely true. Your email is your password. If you own email and access to it, you can reset and request new password.
lathiat 9y ago
Something that I think people underestimate is just how easy it is to observe you entering your password on a phone, and why that (in my opinion) makes thumbprints much more secure than passwords for casual usage - e.g. every-time you unlock your phone. All you need is a camera over your shoulder and you don't even need to observe the key-presses as generally the current character is displayed on screen. You could likely observe 100s or 1000s of them a day with an overhead camera at transit stations and the like. The same thing goes for "Tap And Go" contact less payments not requiring a PIN number under $100. Everyone goes on about how people can run up a few hundred dollars at different stores with your card if they steal it. But consider exposing your pin to surveillance during most common transactions which then also lets you remove cash from an ATM with that card if stolen which is much harder to recover and is also much higher value than the generally $30-$100 limit for transactions without a PIN. Next minute you'll freak out when I tell you I can clone your house key from a photo of it hanging off your belt... The general point is that security trade-offs are generally deeper than you might realise on the surface, especially at "public outrage" levels of observation which so frequently haunt the public mind in recent times.
- riphay 9y ago
  This is a great point, and why I'd like to see more features being locked without a passcode. The move in iOS 11 to restrict device imaging without a passcode is a great step in this direction. Perhaps we can see more customization as to what biometrics unlock and what they don't?
  - consp 9y ago
    As long as biometrics don't unlock secrets (keys, passphrases, shared data etc) it is fine. In all other cases you are correct and it needs some form of replaceable, retractable secret i.e. a passphrase. This would be a very welcome feature but considering how the secret stores work at this point it is not likely to see this any time soon. Sidenote: The false positive rate on any biometrics is way higher than you think (it is highly disadvantageous to be black unfortunately, yes biometrics are racist). People usually consider the near bound (e.g. small sample size, high differentiation unless you have twin) of the people around them as proof it is impossible but this has been problem a fallacy in even mediocre sized studies. It still works but I would really like to see your suggestion to make sure real secrets are properly stored/safe.
cheald 9y ago
Just remember to change your face regularly, and use a face manager so that you don't ever use the same face twice.
- PopsiclePete 9y ago
  It's easy, find a local biker bar and put your hand in a familiar manner on one of the biker's girlfriend's behind.
- Deestan 9y ago
  > I'm sorry, but we can't hire you for security reasons. You look too similar to our head of IT.
unethical_ban 9y ago
Biometric data is authentication. One looks at their mother and says "hi mom" not "what's the passcode?". Your issue, I think, is that you don't trust the tools on the phone to read faces or fingerprints well enough to detect fraudulent login attempts. Factors of authentication: * What you know - things like passwords online that other people shouldn't know * What you have - Two-factor tokens, certs (kind of "know" but used to supplement "have") that other people shouldn't have * What you are - Biometrics like finger, face, or eye that are unique and difficult to duplicate or trick (ideally) So the question becomes which and how many factors to require, and when, depending on the risk model.
- deleted 9y ago
  [deleted]
- ramy_d 9y ago
  What kind of analogy is that? I don't know what you were trying to say but you're way off on saying it. I think OP's point stands, biometrics: are not be relied upon for these matters.
  - nafey 9y ago
    What OP means is that at least theoretically faces contain enough information to uniquely and correctly identify someone, which is the reason why we identify someone by looking at their face. If iPhoneX was as good as a person in recognising faces then this discussion would be meaningless.
- bo1024 9y ago
  > Your issue, I think, is that you don't trust the tools on the phone to read faces or fingerprints And/or, you don't want to give Apple your facial or fingerprint information.
  - 794CD01 9y ago
    How does that work? You put a piece of tape over the front-facing camera?
twblalock 9y ago
Apple is speaking to a broad consumer audience, not just technical people. "Password" is a reasonable concept that will be easily understood by a lot of people. "Biometrics" is not.
codezero 9y ago
I agree and I think most of the comments here cover why this should mostly be OK. Another neat feature in iOS 11 is the ability to disable Touch ID quickly, but touching the lock button five times. I assume this works for Face ID as well – this would help those who have immediate concerns that they would be coerced into using biometric data to unlock their device. edit: updated to five touches
- dkonofalski 9y ago
  Small nitpick, but it's 5 taps to disable Touch ID and Face ID.
  - codezero 9y ago
    A very reasonable nitpick! thanks :)
leyth 9y ago
You've made an excellent point here.
TCM 9y ago
Because people are lazy to remember passwords and or setting pin numbers on their phones. FaceID and TouchID are compromises for an actual password or pin. Also, setting these things up force you to set a 8 digit pin.
- mort96 9y ago
  Definitely this. When I was using an iPhone, it was for all intents and purposes locked behind my thumbprint (even though you could theoretically make a model thumb with my fingerprint and unlock it, it protects from everything other than highly skilled criminals/governments who very specifically target me). Now that I have a Galaxy S5, there's no way I'm writing in a passcode every time I unlock it (and that horrible "fingerprint scanner" is not a replacement for Touch ID), so it's just unlocked.
Clubber 9y ago
>biometric data is a username/id. It's authentication. When it unlocks, it's authorization.
- zaroth 9y ago
  Who you are (authentication) and what you can do (authorization). But for iPhone they are effectively one and the same since there's only one account on the phone. You can only authenticate as the phone's primary user, after which point you have full authority. When, Oh When!, will my kids get their own home screen and separate sandbox, limits, etc. when I hand them my phone?!
curun1r 9y ago
Your both right and both wrong. Biometric authentication is an identity scheme. The combination of username and password is also an identity scheme. A certificate chain is another identity scheme. Identities both identify who you are and are, ideally, difficult to fake. Username password artificially handled those two concerns separately, but that doesn't mean that all identity schemes must do so. For them to say it's your password is wrong, but for you to say it's your username is also wrong. It can be thought of as both or neither but it isn't either one on its own.
Geee 9y ago
In a perfect world, we wouldn't actually need passwords. If a machine can reliably tell that you are really you, then what's the point of passwords? That actually works very well between humans; we let friends in our house without asking for passwords. Machines still have a bit of catching up to do, but Face ID is a step in the right direction.
oatmealsnap 9y ago
Because it is safe enough for most people to keep their friends out of their phones, and faster+easier to use than typing in a passphrase. It is also safer than not using a password, which I'm sure some people still do.
wentoodeep 9y ago
I agree, what about identical twins or a doppleganger?
_asummers 9y ago
I consider biometric data a keepalive, nothing more. Any biometric system that doesn't require a non biometric pass at some point after boot before the biometric becomes a means of device authentication is broken, to me.
- MBCook 9y ago
  In iOS you have to provide the passcode to change any settings related to payments and security (among other things.) Anytime you go 24 hours without unlocking your phone you are also required to give the passcode.
  - zimpenfish 9y ago
    Also have to give the passcode on boot to enable the biometric shortcuts.
tootie 9y ago
I had face unlock maybe 2 Androids ago and it was disallowed by corporate IT policy. PINs only or you couldn't get company email.
- briandear 9y ago
  Because you could unlock Androids with a photo — even a low resolution Facebook photo. A 3D scan of your face is a bit beyond the Android scheme.
  - pmlnr 9y ago
    If only we had high resolution 3d printers or people who can carve lifelike portrait replicas out of stone! Oh, wait, we do. A bit more complicated, but if you think this is not way to simple to fool, you're out of luck. Blood vessel scanner, or get out, see http://nsmartphone.com/fujitsu-lifebook-u745-review/ http://nsmartphone.com/fujitsu-lifebook-u745-review/
    - adbachman 9y ago
      If they can build a captcha that keeps out robots based on mouse movements, I'm pretty sure they can build a facial recognition system that can keep out prosthetics based on facial gestures.
hota_mazi 9y ago
Equifax has taught us that you'll be perfectly safe if you regularly change your address, date of birth and SSN. Apple is just following suit with the trend.
toephu2 9y ago
Wow you sound like a real joy to work with. I don't think you've learned to step out of the shoes of an engineer and put yourself in the shoes of an average consumer or the company selling a new phone. The average consumer does not give a shit about the technical definition of a password.
yladiz 9y ago
Is your face scan really publicly available?
marcomonteiro 9y ago
Isn't it though? It's the "password" to the secure enclave which then provides a "password" to the OS. Edit: I agree with your statement that "a password is something i can change if it gets compromised. a password is secure from others." Which is why I like that there is a method for disabling TouchID/FaceID with iOS 11.

pwython 9y ago

"My v̶o̶i̶c̶e̶ face is my passport. Verify me." 'Sneakers' had it right. Consider it more of a "passport."

sjwright 9y ago

> biometric data is a username/id. Which is why it's called "Touch ID" and "Face ID".

eCa 9y ago
> Your face is now your password. That's a direct quote from the product page.
jasonkostempski 9y ago
Yet they behave like a password.
- dkonofalski 9y ago
  No they don't. They behave like a username/password combination. A username is an individual identifier and a password is a confirmation that the identifier is valid for the person it's identifying. TouchID and FaceID confirm both - that it's the correct user that has access and that the user is who they say they are.
haswell 9y ago
It's important to note that in the context of these Apple features, "ID" is for "Identification", not some kind of "User ID" used as a Username. Username != ID.

eCa 9y ago

Agreed completely. I hope I'm never in a situation where I'm forced to use my face or fingers as a password.

nilkn 9y ago

Their job is to sell. They want everyone watching to understand exactly what they mean. For what it's worth, I would say that Face ID isn't quite a username either. Once known, anyone can reproduce a username. I can't easily recreate your face even if I know you well. That would require an extra set of skills/equipment. The same argument goes for Touch ID.

Spooky23 9y ago
It isn't a username or password, it's another factor, similar to how we identify people that we know. It's not perfect, which is why we have policies for accessing things. It's almost certainly a better security mechanism than a password.

audunw 9y ago

> biometric data is a username/id. > why do companies insist on getting this shit backwards? They don't have it backwards, but they're also simplifying when they say it's your password. In the presentation they actually say specifically that there's a chance that someone else can unlock your phone (1 in 50'000 for fingerprint, and supposedly 1 in 1'000'000 for Face ID, given that you don't have a twin). Reality is that it's somewhere in between. A fingerprint sensor or face reader will keep casual snoopers - and most people who find your phone on the street - out. That's all that matters for most people. It's not a username. It's at least moderately hard for someone to duplicate, and it's not something you'd actively share with someone. It's not as safe as a password, but Apple isn't trying to claim that either. I think it's a good idea to avoid false dichotomy here. Biometrics is biometrics. It should be treated as distinct from passwords or usernames.

tentaTherapist 9y ago
Okay, but shouldn't developers make security easy? This makes introducing a sizable hole into existing security easy, which is the opposite of what you'd want.
aquadrop 9y ago
Yes, touchId/faceId sits in between, it's quick access token, which is enough for 95% of the time, but those other 5% are very important.
- jachee 9y ago
  Those other 5% might be too important to have your phone involved with them.
  - arielpts 9y ago
    Or, if one needs those 5% moments on phones, it's always a possibility (as stated on the keynote) to add password additionally.
a_t48 9y ago
1 in 1 000 000 is the same odds as a 6 digit PIN (though you can always change a PIN). That's acceptable to me.

electrograv 9y ago

It's not a password, but it's not a username either. It's something in between: It's vastly easier for me to type your username in the login box than it is for me to create a sophisticated prosthetic or high resolution 3D scan (with correct infrared coloration) of your face.

mikeash 9y ago
I wish people would stop repeating the canard that biometrics are usernames, not passwords. Biometrics are biometrics. They are different from both usernames and passwords. They have their own advantages and limitations. Learn them, understand them, and use them or not based on what they are, not some other thing they sort of seem like.
threeseed 9y ago
Prosthetics were specifically covered in the keynote. The neural networks have been trained to recognise them as fake faces.
- Dylan16807 9y ago
  They're not magic. You can make a fake with enough effort. But it's a lot of effort.
- jomido 9y ago
  http://www.evolvingai.org/fooling http://www.evolvingai.org/fooling
- briandear 9y ago
  The weird thing to me is that apparently we have so many people on HN that consider themselves worth the effort to make full 3D renderings of their faces just to unlock a phone. Unless you were Osama Bin Laden, it seems highly unlikely anyone would go to the trouble. If you are that kind of person, you’re probably going to be protecting your information with much more than Face ID.
  - SturgeonsLaw 9y ago

amaks 9y ago

Not entirely true. Your email is your password. If you own email and access to it, you can reset and request new password.

lathiat 9y ago

Something that I think people underestimate is just how easy it is to observe you entering your password on a phone, and why that (in my opinion) makes thumbprints much more secure than passwords for casual usage - e.g. every-time you unlock your phone. All you need is a camera over your shoulder and you don't even need to observe the key-presses as generally the current character is displayed on screen. You could likely observe 100s or 1000s of them a day with an overhead camera at transit stations and the like. The same thing goes for "Tap And Go" contact less payments not requiring a PIN number under $100. Everyone goes on about how people can run up a few hundred dollars at different stores with your card if they steal it. But consider exposing your pin to surveillance during most common transactions which then also lets you remove cash from an ATM with that card if stolen which is much harder to recover and is also much higher value than the generally $30-$100 limit for transactions without a PIN. Next minute you'll freak out when I tell you I can clone your house key from a photo of it hanging off your belt... The general point is that security trade-offs are generally deeper than you might realise on the surface, especially at "public outrage" levels of observation which so frequently haunt the public mind in recent times.

riphay 9y ago
This is a great point, and why I'd like to see more features being locked without a passcode. The move in iOS 11 to restrict device imaging without a passcode is a great step in this direction. Perhaps we can see more customization as to what biometrics unlock and what they don't?
- consp 9y ago
  As long as biometrics don't unlock secrets (keys, passphrases, shared data etc) it is fine. In all other cases you are correct and it needs some form of replaceable, retractable secret i.e. a passphrase. This would be a very welcome feature but considering how the secret stores work at this point it is not likely to see this any time soon. Sidenote: The false positive rate on any biometrics is way higher than you think (it is highly disadvantageous to be black unfortunately, yes biometrics are racist). People usually consider the near bound (e.g. small sample size, high differentiation unless you have twin) of the people around them as proof it is impossible but this has been problem a fallacy in even mediocre sized studies. It still works but I would really like to see your suggestion to make sure real secrets are properly stored/safe.

cheald 9y ago

Just remember to change your face regularly, and use a face manager so that you don't ever use the same face twice.

PopsiclePete 9y ago
It's easy, find a local biker bar and put your hand in a familiar manner on one of the biker's girlfriend's behind.
Deestan 9y ago
> I'm sorry, but we can't hire you for security reasons. You look too similar to our head of IT.

unethical_ban 9y ago

Biometric data is authentication. One looks at their mother and says "hi mom" not "what's the passcode?". Your issue, I think, is that you don't trust the tools on the phone to read faces or fingerprints well enough to detect fraudulent login attempts. Factors of authentication: * What you know - things like passwords online that other people shouldn't know * What you have - Two-factor tokens, certs (kind of "know" but used to supplement "have") that other people shouldn't have * What you are - Biometrics like finger, face, or eye that are unique and difficult to duplicate or trick (ideally) So the question becomes which and how many factors to require, and when, depending on the risk model.

deleted 9y ago
[deleted]
ramy_d 9y ago
What kind of analogy is that? I don't know what you were trying to say but you're way off on saying it. I think OP's point stands, biometrics: are not be relied upon for these matters.
- nafey 9y ago
  What OP means is that at least theoretically faces contain enough information to uniquely and correctly identify someone, which is the reason why we identify someone by looking at their face. If iPhoneX was as good as a person in recognising faces then this discussion would be meaningless.
bo1024 9y ago
> Your issue, I think, is that you don't trust the tools on the phone to read faces or fingerprints And/or, you don't want to give Apple your facial or fingerprint information.
- 794CD01 9y ago
  How does that work? You put a piece of tape over the front-facing camera?

twblalock 9y ago

Apple is speaking to a broad consumer audience, not just technical people. "Password" is a reasonable concept that will be easily understood by a lot of people. "Biometrics" is not.

codezero 9y ago

I agree and I think most of the comments here cover why this should mostly be OK. Another neat feature in iOS 11 is the ability to disable Touch ID quickly, but touching the lock button five times. I assume this works for Face ID as well – this would help those who have immediate concerns that they would be coerced into using biometric data to unlock their device. edit: updated to five touches

dkonofalski 9y ago
Small nitpick, but it's 5 taps to disable Touch ID and Face ID.
- codezero 9y ago
  A very reasonable nitpick! thanks :)

leyth 9y ago

You've made an excellent point here.

TCM 9y ago

Because people are lazy to remember passwords and or setting pin numbers on their phones. FaceID and TouchID are compromises for an actual password or pin. Also, setting these things up force you to set a 8 digit pin.

mort96 9y ago
Definitely this. When I was using an iPhone, it was for all intents and purposes locked behind my thumbprint (even though you could theoretically make a model thumb with my fingerprint and unlock it, it protects from everything other than highly skilled criminals/governments who very specifically target me). Now that I have a Galaxy S5, there's no way I'm writing in a passcode every time I unlock it (and that horrible "fingerprint scanner" is not a replacement for Touch ID), so it's just unlocked.

Clubber 9y ago

>biometric data is a username/id. It's authentication. When it unlocks, it's authorization.

zaroth 9y ago
Who you are (authentication) and what you can do (authorization). But for iPhone they are effectively one and the same since there's only one account on the phone. You can only authenticate as the phone's primary user, after which point you have full authority. When, Oh When!, will my kids get their own home screen and separate sandbox, limits, etc. when I hand them my phone?!

curun1r 9y ago

Your both right and both wrong. Biometric authentication is an identity scheme. The combination of username and password is also an identity scheme. A certificate chain is another identity scheme. Identities both identify who you are and are, ideally, difficult to fake. Username password artificially handled those two concerns separately, but that doesn't mean that all identity schemes must do so. For them to say it's your password is wrong, but for you to say it's your username is also wrong. It can be thought of as both or neither but it isn't either one on its own.

Geee 9y ago

In a perfect world, we wouldn't actually need passwords. If a machine can reliably tell that you are really you, then what's the point of passwords? That actually works very well between humans; we let friends in our house without asking for passwords. Machines still have a bit of catching up to do, but Face ID is a step in the right direction.

oatmealsnap 9y ago

Because it is safe enough for most people to keep their friends out of their phones, and faster+easier to use than typing in a passphrase. It is also safer than not using a password, which I'm sure some people still do.

wentoodeep 9y ago

I agree, what about identical twins or a doppleganger?

_asummers 9y ago

I consider biometric data a keepalive, nothing more. Any biometric system that doesn't require a non biometric pass at some point after boot before the biometric becomes a means of device authentication is broken, to me.

MBCook 9y ago
In iOS you have to provide the passcode to change any settings related to payments and security (among other things.) Anytime you go 24 hours without unlocking your phone you are also required to give the passcode.
- zimpenfish 9y ago
  Also have to give the passcode on boot to enable the biometric shortcuts.

tootie 9y ago

I had face unlock maybe 2 Androids ago and it was disallowed by corporate IT policy. PINs only or you couldn't get company email.

briandear 9y ago
Because you could unlock Androids with a photo — even a low resolution Facebook photo. A 3D scan of your face is a bit beyond the Android scheme.
- pmlnr 9y ago
  If only we had high resolution 3d printers or people who can carve lifelike portrait replicas out of stone! Oh, wait, we do. A bit more complicated, but if you think this is not way to simple to fool, you're out of luck. Blood vessel scanner, or get out, see http://nsmartphone.com/fujitsu-lifebook-u745-review/ http://nsmartphone.com/fujitsu-lifebook-u745-review/
  - adbachman 9y ago
    If they can build a captcha that keeps out robots based on mouse movements, I'm pretty sure they can build a facial recognition system that can keep out prosthetics based on facial gestures.

hota_mazi 9y ago

Equifax has taught us that you'll be perfectly safe if you regularly change your address, date of birth and SSN. Apple is just following suit with the trend.

toephu2 9y ago

Wow you sound like a real joy to work with. I don't think you've learned to step out of the shoes of an engineer and put yourself in the shoes of an average consumer or the company selling a new phone. The average consumer does not give a shit about the technical definition of a password.

yladiz 9y ago

Is your face scan really publicly available?

marcomonteiro 9y ago

Isn't it though? It's the "password" to the secure enclave which then provides a "password" to the OS. Edit: I agree with your statement that "a password is something i can change if it gets compromised. a password is secure from others." Which is why I like that there is a method for disabling TouchID/FaceID with iOS 11.