12 ms·

I'll bet most people who dismiss TouchID and FaceID as useless because they're "usernames" and not "passwords", have a bog standard lock and key on their house.

I'll bet most people who dismiss TouchID and FaceID as useless because they're "usernames" and not "passwords", have a bog standard lock and key on their house. Funny thing about those house keys. They can be stolen, lost, or duplicated from pictures. But TouchID and FaceID have liveness tests to prevent forgeries, your biometrics can't be easily stolen, and you can't lose them. A house key is called a "key" though, so it must be a password, and thus must be secure! And biometrics are just usernames, so they're useless and insecure! Sarcasm aside, my point is this. Even with the worst biometrics, your phone would be more secure than 99% of houses. And I don't see people complaining about the state of home security... Ultimately, these username vs. password analogies are shallow understandings of security, and at best flawed. Biometrics, passwords, house keys, secure dongles, etc. Those are _all_ keys. What they differ in is how reproducible they are, how easily they're lost, and how easily they're bypassed. For example: Biometrics, when measured by devices with sufficient liveness tests, are robust against forgeries. That means they can't be stolen. This is in contrast to passwords and pincodes, which can be stolen by eyeballs, cameras, audio recording devices, etc. You can use FaceID or TouchID to unlock your phone in front of all the recording devices in the world, and yet still your biometric key won't be stolen. See how that example comparison is far more interesting and enlightening than "biometrics are usernames, so they're pointless"? * Of course, when I refer to household locks and keys, I mean your average household lock. There are, of course, premium locks with keys that can't be reproduced. But most houses have locks that you can sneeze on and open.

sorenjan 9y ago
If I lose my house key I can change the locks and make the old key worthless. How do you change biometric keys once they're compromised?
- namelost 9y ago
  You can turn it off. Or you can apply a threat model and determine whether the people for whom TouchID/FaceID is keeping your phone secure against would have the resources to mount such an attack.
  - dsp1234 9y ago
    How do you change biometric keys once they're compromised? You can turn it off. Is "don't use a lock" really the answer to "my key was stolen"?
    - nicky0 9y ago
      I think it's more a case of "use a different lock". That is, use a passcode.
    - schrodinger 9y ago
      Turning off FaceID isn't "don't use a lock", it's "use a password instead."
- MBCook 9y ago
  https://danielmiessler.com/blog/why-biometric-data-breaches-wont-require-you-to-change-your-body/ https://danielmiessler.com/blog/why-biometric-data-breaches-... I submitted this earlier today but it didn’t get traction. Basically it could be done.
  - dmd 9y ago
    But your argument makes no sense. The attack isn't "someone stole the processed image ("stick figure") of my fingerprint", the attack is someone copied my fingerprint.
    - MBCook 9y ago
      That’s TouchID. Can they reasonably steal a full perfect 3D map of your face that can pass the attention checks and whatever FaceID uses to determine its you? The fingerprint argument isn’t an argument against FaceID. And it’s still kind of pointless because Apple put out figures a few years ago that TouchID lead to a ~50% INCREASE in locked phones. You seem to be arguing that a secure passcode without biometrics is better. It seems that if the public can’t use biometrics they prefer NO security. So even with that ‘flaw’ it’s no worse (often MICH better) for everyone.
      - dmd 9y ago
        Oh, no, I absolutely agree that biometrics overall increase security for everyone. My argument is entirely a pedantic one. FaceID is clearly an improvement precisely because it makes stealing your "original" biometrics much more difficult.
        MBCook 9y ago
        But that’s all we’ve seen in EVERY thread about FaceID. “Biometrics are evil because you can’t change them.” Or “They’re usernames/passwords/whatever.” Or “FaceID can be subverted by a nation state with 3 years and $75 trillion”. Or “You can just unlock it with a single picture from Twitter.” And of course “If only they added an esoteric and complex method of unlocking a fake environment under duress by winking the word tomato backward in French Morse code...” None of it seems helpful. Using a FaceID discussion to argue TouchID is insecure... seems pointless. The arguments about how it can be bypassed (supposedly) with JUST a 3D printer and thousands of high resolution photos and a video of you looking into a camera and........ come on. This stuff would be unbelievable in an Oceans 11 sequel. And people argue as if FaceID has to be perfect when it replaces a fingerprint (which is easier to fake) or basically nothing. We’re not securing the Crown Jewels here. We’re trying to keep the guy next to you at the bar from tweeting as you. So in the end there is no useful on top discussion. It’s just a irrelevant story that people can use to tell about their pet biometric issues even when they don’t fit. People are still arguing about things Apple said during the initial keynote. The only one I don’t see from before is the ‘will it work in the dark’ question which Apple explicitly mentioned in the keynote. I want to know more about FaceID from people who know more about security. Instead we’re discussing how the technology it replaced is bad and fringe internet conspiracy theory level nonsense. Edit to add one more thing: maybe this is rose colored glasses but I don’t remember the threads around TouchID being anywhere near this bad. People argued over how easy it was to get a fingerprint, sure. That’s fair. But the rest of the discussion seemed much more relevant.
- c22 9y ago
  It sounds like fpgaminer's argument is that biometric keys can't be compromised because of "liveness tests". An argument against would have to rebut this assumption. My gut instinct tells me that this assumption is absurd, but I lack the specific knowledge of these systems to prove it.
  - chimeracoder 9y ago
    > It sounds like fpgaminer's argument is that biometric keys can't be compromised because of "liveness tests". You're arrested, and the cops hold the phone up to your face to unlock it. That's a pretty big compromise, and there's literally nothing you can do to prevent it.
    - kickling 9y ago
      I heard in another comment in this thread it has focus detection, so you would have to look at the phone for it to unlock. Can not find any other source of this though.
      - djrogers 9y ago
        > Can not find any other source of this though. It's in the marketing materials for the phone, was mentioned multiple times on stage during the introduction, and is in the introduction to the whitepaper that this entire HN thread is about. So yeah - a couple of sources are available...
    - coldtea 9y ago
      The same holds true for physical keys. If you're arrested then the cops can tie you, grab the keys and unlock your door "and there's literally nothing you can do to prevent it.". Also some guy can just make a copy your key (pretty trivial) -- heck people can even break your door bypassing the key altogether.
      - chimeracoder 9y ago
        > The same holds true for physical keys. Nobody's saying that home security is good. The point the parent was making is that, even with a "liveness test", compared to other biometric identification, this is a regression from fingerprint-based authentication for the iPhone.
- eeeeeeeeeeeee 9y ago
  You turn it off until it's been confirmed secure again. This is not much different from any security issue in software -- you disable the functionality until it's secure again. The only risk is if somebody cracks the entire FaceID model and Apple cannot fix it in software. But even then, you would still disable FaceID and either return your phone or wait for a recall.
  - Sir_Cmpwn 9y ago
    You can't replace your face. Are you suggesting that people turn it off until it's secure again meaning, like, plastic surgery?
    - eeeeeeeeeeeee 9y ago
      You can't!? Wow, thanks for teaching me that. Did you even read what I wrote? You would turn off FaceID and revert back to a passcode/passphrase until it is fixed in software.
      - Sir_Cmpwn 9y ago
        Until what's fixed in software? Your face being compromised? You can't fix a leaked secret in software.
        eeeeeeeeeeeee 9y ago
        You are implying that there is a "secret" based on that face mapping that can be copied out of the device and then used to either 1) gain access to a non-Apple system that has some kind of biometric face detection system or 2) can be used to reproduce a face like yours to unlock your phone without you present From the PDF: "Once it confirms the presence of an attentive face, the TrueDepth camera projects and reads over 30,000 infrared dots to form a depth map of the face, along with a 2D infrared image. This data is used to create a sequence of 2D images and depth maps, which are digitally signed and sent to the Secure Enclave. To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. A portion of the A11 Bionic chip’s neural engine—protected within the Secure Enclave—transforms this data into a mathematical representation and compares that representation to the enrolled facial data. This enrolled facial data is itself a mathematical representation of your face captured across a variety of poses. " So, it's more like a hash of your face, which is very similar to how TouchID works. So, again, even if someone were able to break into the secure enclave and get that data, what could they do with it? It's a representation of yourself that is used for Apple devices. Also, this is an OPTIONAL feature. If it doesn't fit your security model, don't use it. For the same reason a lot of people don't use TouchID -- they want the security of a passphrase. But for 90%+ of people that will buy that phone and are not at risk of the government or police pursuing them, the security it offers is more than adequate and it achieves this by not annoying the user and requiring them to have a 50 character passphrase.
- wmertens 9y ago
  Tell apple they can only recognize your face if it shows a certain expression
fnl 9y ago
That isn't taking into account how frequent relative to all such target objects an attack occurs. If a (much?) smaller percentage of houses get burglarized vs. number of phones broken into, then security requirements are not really comparable. (Note that I have zero idea of or even guess for the sizes of either, though.)
bagacrap 9y ago
I have a house with a standard lock. A couple years ago someone decided to kick the front door in while I was at work. We have shitty house locks because the entire system is terribly insecure and strengthening one link in the chain is pointless.
- deleted 9y ago
  [deleted]
- KGIII 9y ago
  Physical locks just keep honest people honest. Also, OP says you can't lose your biometrics. You can, it's just painful and you'll not be the least bit happy about it.
- 21 9y ago
  There are better doors out there: https://www.youtube.com/watch?v=Bk48kU6fGWc https://www.youtube.com/watch?v=Bk48kU6fGWc
chrisfosterelli 9y ago
> Even with the worst biometrics, your phone would be more secure than 99% of houses. And I don't see people complaining about the state of home security... 1. Many (most?) people have more private information on their phones than they do in their house, and there is different risks of each being compromised, so there should be different standards. 2. My impression of the security community is that pretty much everyone uniformly agrees that home security is garbage and needs to be improved.
solatic 9y ago
> And I don't see people complaining about the state of home security... Home security is a really poor analogy. * Attacking everybody's house at once is not scalable, unlike attacking many people's electronic devices at once. Furthermore, defending against a SWAT team armed with a search warrant is nigh impossible, no matter what lock you put on your front door. * The contents of most people's houses is far more weighted to "things which would be a hassle to file with insurance to replace" and less "it would ruin my life if this got into the wrong hands", and their strategy for home defense is weighted as such. * Many people whose strategy for home defense (well, in the US) is more serious, will weigh more towards weapons / guns and less to the actual locks on the doors. What would a digital equivalent be? A prick of poison for anybody who picks up a phone which doesn't belong to them? The analogy totally breaks down in context.
- btown 9y ago
  The analogy is one of defense in depth: if you're serious about security, you can use memorized & typed secondary passwords on secure apps, such as secure notes in 1Password, or an app like https://guardianproject.info/apps/pixelknot/ https://guardianproject.info/apps/pixelknot/ that would steganographically encode secure notes into otherwise normal photos, potentially with independent passwords for complete deniability. A locked door and a face-locked iPhone are only the first line of defense, and are largely for convenience's sake in both daily use/as a deterrent and in the case of physically being distant from your property. The "guns" are entirely independent.
  - splintercell 9y ago
    I am not a huge fan of Steganography in images. There are far too many services out there which take the liberty of modifying or re-encoding your images to a different format for various reasons. Is there a lossless medium which can be used for steganography?
    - anko 9y ago
      If it's lossless, then where do you hide the message? In "comment" sections? Not very well hidden. How many formats are there where you can intentionally encode something with meaningless characters?
lechiffre10 9y ago
So basically you are saying that a bad biometric that would allow someone to use a face mask and walk into your home easily would still be better than 99% of house keys?
mbgerring 9y ago
It all depends on your threat model. Police are perfectly capable of breaking into my home, but it doesn't matter, because if they do it without a warrant everything they find is inadmissible in court. Whereas with FaceID, if I'm arrested and they point my phone at my face to unlock it against my will, anything they find is now admissible as evidence.
- wmertens 9y ago
  I keep hoping that FaceID will also get FacePassword, where you have to show one or more expressions in order. Then it becomes a password, and the police can't force you to change your expression.
  - dragonwriter 9y ago
    To the extent the police can legally compel you to provide access to a device, the means by which that access is protected does not impede their legal capability to do it and impose consequences for non-compliance.
    - mbgerring 9y ago
      That's the thing -- the police can't legally compel you to provide them access to your device, but if they can get it without you having to give them anything, by, say, pointing the phone at your face, it's fair game. I don't have time to look up the court precedents about this, but that's my understanding of the current state of the law.
      - dragonwriter 9y ago
        I misread the upthread comment as implying that FaceID “passwords” were more legally secure than regular passwords, not just more legally secure than plain FaceID. I agree that the description you provide is generally correct.
      - jsjohnst 9y ago
        > the police can't legally compel you to provide them access to your device Your understanding of the current state of the law is very wrong. There's a person in the US [0] who has been in jail for multiple years now without being tried / convicted due to refusing to provide access to their devices. There's another case with a warrant[1] allowing an officer to force someone to unlock their phone protected by TouchID. I have also heard multiple US states have enacted laws specifically addressing device unlock, but I don't have links to them at the moment. [0] https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-years-for-refusing-to-decrypt-drives-will-he-ever-get-out/ https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-ye... [1] http://files.cloudprivacy.net/la-iphone-fingerprint-warrant.pdf http://files.cloudprivacy.net/la-iphone-fingerprint-warrant....
ct0 9y ago
The username is the face, the password is the pattern of blinking or a unique expression the user displays to the camera.
ecesena 9y ago
The problem with biometrics is not username vs password, biometrics are password. The problem is that these are client-side protections, and there's no data sent to a server that can verify the identity. And you can't build a remote identity verification with this data, because there's no way for the user to change it and revoke it (let alone it's very privacy sensitive). The biometric access control systems (the one "in the movies", palm recognition, retina scanners...) implicitly assume that the connection between the sensor and the central server is secure, and that the user authorized it's data to be in the database. This model doesn't apply to "general users" and "internet companies". Research in biometric security aims at finding functions of your biometric data that can be revoked and it's not privacy sensitive. Edit: with "revoke" I don't mean remove it. I mean revoke one and set another one, like you can do for a password/pin, or for a phone number/hw device.
- deleted 9y ago
  [deleted]
- Fnoord 9y ago
  > The problem with biometrics is not username vs password, biometrics are password. Yes, that is the problem. No, biometrics are not password. Please stop spouting this nonsense? Biometrics are akin to username; they suggest your identity, but don't authenticate you. They should not be used as password because they cannot be changed, and cannot be kept secret. A password (or better, TOTP authentication) can be changed, and can be kept secret; a hardware fingerprint scanner (or face or iris scanner) cannot be changed, and can be faked by any semi-intelligent person or organization. Fingerprint can already be stolen and used in identity theft. We saw this various years ago in CCC when a German minister got his/her fingerprints stolen as a way to prove the insecurity. It is only a matter of time when the common people learn about how to trick face recognition and iris recognition. In the meantime, strong passwords and (preferably) TOTP is secure. Use that instead. > Research in biometric security aims at finding functions of your biometric data that can be revoked and it's not privacy sensitive. Cat and mouse game, and wrong premise: biometrics cannot be revoked. They're permanent.
  - dkonofalski 9y ago
ramses0 9y ago
Very important point (re: house key analogy). Houses and cars are 1000% not secure, you can always break a window and get access. That's why they have ARMORED cars and bank VAULTS or safes. However, if you break a window, or drill a hole in a safe, there is "visible sign of forced entry". https://en.wikipedia.org/wiki/Forcible_entry https://en.wikipedia.org/wiki/Forcible_entry When you see a broken window by your front door, when you see a broken window on your car, when you see a hole cut through sheetrock next to your door, or you see your door blasted off it's hinges, you know that the security of the device has been compromised. That's truly what's missing on device security nowadays: "Signs of Forced Entry" ... number of incorrect password attempts, number of incorrect FaceID / TouchID attempts, etc. And if your device is rooted or untrusted, then there's often not a good, trusted, visible way to see that security has been actually compromised (as opposed to attempted to be compromised).
- Osmium 9y ago
  You raise very good points, but it's not like there aren't ways to break into a house without signs of forced entry. To my mind, privacy is often the most important difference. There are a lot more private things on my phone than in my house, honestly -- a phone these days is often almost an extension of the mind. Which is why we should hold it to a higher standard. I personally have no problems with TouchID/FaceID, I think the secure enclave is great, but I still think there's a lot of room for improvement, better sandboxing of data, better tripwires for when data is accessed/transferred, etc.
mtgx 9y ago
> your biometrics can't be easily stolen, and you can't lose them. Fingerprints are very different from face. Someone has to actually follow you around and clone your fingerprint from something you touched. With facial unlock, as virtually all previous systems have demonstrated, you usually only need someone's online photo, or a close variation of that to unlock a device/system that uses face unlock. With everyone plastering their photos in high resolution all over the web these days, and with machine learning advancing so fast these days, how long until a system like this is defeated? Do you really think "3D photos" of you can't be created? Or even ones that test for "liveness". What exactly do you think that "liveness test" is? It's just an algorithm that Apple uses. That algorithm can be reverse-engineered. Also, Apple's Face ID has a False Acceptance Rate of 1 million versus TouchID "only" 50,000, is very misleading. That metric only works when you think of an attacker throwing completely random faces at the system. Do you think an attacker that wants your phone is going to throw random faces at the device? Or do you think it's far more likely that it will start building that 3D profile out of your high-resolution online photos? Suddenly that 1 million FAR becomes much smaller, as the difference in profile from what the attacker has already gathered on you from public websites is much smaller than how you look like in real life. This is what may actually make the Face ID system less secure overall than TouchID. It's just way way easier to get someone's pictures than it is to get their fingerprints.
- a_t48 9y ago
  > Do you really think "3D photos" of you can't be created? Or even ones that test for "liveness". What exactly do you think that "liveness test" is? It's just an algorithm that Apple uses. That algorithm can be reverse-engineered. I believe it was doing infrared detection.
greendude29 9y ago
This is farcical.
post_break 9y ago
My twin can't use his house key to get into my house.
jdavis703 9y ago
The thing is I'm not really too concerned about my home's physical security (I lock the door, but the entire attack surface area is too large for my risk profile to lock it down extensively). If the cops want to search my house, they can kick the door in. If a thief wants to take something they can break a window. If a fraudster wants to trick my landlord into letting them in they could do so. As a result truly important property and information is fully secured using passcodes and pin numbers.
Fnoord 9y ago
Its more nuanced than you put it with physical keys. Consider for a moment the baklava [1]. A baklava increases anonymity of an attacker (ie. burglar in our discussion), but also increases suspiciousness of victims and 3rd parties (ie. innocent bystanders, witnesses). Physical burglary has many of these nuances, trade-offs. A key on a front door is meant to keep an attacker out for as long as they get caught and/or identified, or become afraid they get caught and/or identified. It isn't meant to stop an attacker to enter a house. If an attacker wants to enter your house, they can just break in via a window. Various techniques exist for that, some are noisy, others are more sophisticated and aren't noisy. Someone who's trying to enter via a window by night though is suspicious which means the attacker might be noticed and get caught. Most normal house keys [at least here in NL] are very cheap and have a lot of vulnerabilities, they have weak entropy (e.g. 6 entries with 6 options each), or are vulnerable via lock bumping (takes max 10 sec to enter and doesn't look very suspicious). With electronic devices, its more binary, but it depends a lot on whom you're defending against. Petty criminals, technical criminals, or state actors. > This is in contrast to passwords and pincodes, which can be stolen by eyeballs, cameras, audio recording devices, etc. Yes, passwords can be stolen by eyeballs and cameras and Van Eck phreaking (TEMPEST). However if combined with TOTP it becomes something you have and something you know. Facial recognition is just a form of something you have, and the key cannot be changed. They key can be put off, but that is not more secure than having TOTP on your watch (with yes/no button) and being able to disable the authentication method on your phone by pressing the power button 5 times. Liveness is just obscurity. Its gonna be insecure at some point, and you'll be begging Apple for a newer, more secure solution at that point. Pray they still support your advice by then. [1] Yes, thank you, balaclava (bivakmuts in my primary language). I have difficulty pronouncing and remembering the word. I'll keep it as-is for readability of the discussion, and for admitting my mistake.
- anamexis 9y ago
  Note - I think you mean balaclava. Baklava is a delicious Greek dessert.
test001only 9y ago
You can refuse to give out a password or claim you forgot, but with biometrics there is not much of an option.

sorenjan 9y ago

If I lose my house key I can change the locks and make the old key worthless. How do you change biometric keys once they're compromised?

namelost 9y ago
You can turn it off. Or you can apply a threat model and determine whether the people for whom TouchID/FaceID is keeping your phone secure against would have the resources to mount such an attack.
- dsp1234 9y ago
  How do you change biometric keys once they're compromised? You can turn it off. Is "don't use a lock" really the answer to "my key was stolen"?
  - nicky0 9y ago
    I think it's more a case of "use a different lock". That is, use a passcode.
  - schrodinger 9y ago
    Turning off FaceID isn't "don't use a lock", it's "use a password instead."
MBCook 9y ago
https://danielmiessler.com/blog/why-biometric-data-breaches-wont-require-you-to-change-your-body/ https://danielmiessler.com/blog/why-biometric-data-breaches-... I submitted this earlier today but it didn’t get traction. Basically it could be done.
- dmd 9y ago
  But your argument makes no sense. The attack isn't "someone stole the processed image ("stick figure") of my fingerprint", the attack is someone copied my fingerprint.
  - MBCook 9y ago
    That’s TouchID. Can they reasonably steal a full perfect 3D map of your face that can pass the attention checks and whatever FaceID uses to determine its you? The fingerprint argument isn’t an argument against FaceID. And it’s still kind of pointless because Apple put out figures a few years ago that TouchID lead to a ~50% INCREASE in locked phones. You seem to be arguing that a secure passcode without biometrics is better. It seems that if the public can’t use biometrics they prefer NO security. So even with that ‘flaw’ it’s no worse (often MICH better) for everyone.
    - dmd 9y ago
      Oh, no, I absolutely agree that biometrics overall increase security for everyone. My argument is entirely a pedantic one. FaceID is clearly an improvement precisely because it makes stealing your "original" biometrics much more difficult.
      - MBCook 9y ago
        But that’s all we’ve seen in EVERY thread about FaceID. “Biometrics are evil because you can’t change them.” Or “They’re usernames/passwords/whatever.” Or “FaceID can be subverted by a nation state with 3 years and $75 trillion”. Or “You can just unlock it with a single picture from Twitter.” And of course “If only they added an esoteric and complex method of unlocking a fake environment under duress by winking the word tomato backward in French Morse code...” None of it seems helpful. Using a FaceID discussion to argue TouchID is insecure... seems pointless. The arguments about how it can be bypassed (supposedly) with JUST a 3D printer and thousands of high resolution photos and a video of you looking into a camera and........ come on. This stuff would be unbelievable in an Oceans 11 sequel. And people argue as if FaceID has to be perfect when it replaces a fingerprint (which is easier to fake) or basically nothing. We’re not securing the Crown Jewels here. We’re trying to keep the guy next to you at the bar from tweeting as you. So in the end there is no useful on top discussion. It’s just a irrelevant story that people can use to tell about their pet biometric issues even when they don’t fit. People are still arguing about things Apple said during the initial keynote. The only one I don’t see from before is the ‘will it work in the dark’ question which Apple explicitly mentioned in the keynote. I want to know more about FaceID from people who know more about security. Instead we’re discussing how the technology it replaced is bad and fringe internet conspiracy theory level nonsense. Edit to add one more thing: maybe this is rose colored glasses but I don’t remember the threads around TouchID being anywhere near this bad. People argued over how easy it was to get a fingerprint, sure. That’s fair. But the rest of the discussion seemed much more relevant.
c22 9y ago
It sounds like fpgaminer's argument is that biometric keys can't be compromised because of "liveness tests". An argument against would have to rebut this assumption. My gut instinct tells me that this assumption is absurd, but I lack the specific knowledge of these systems to prove it.
- chimeracoder 9y ago
  > It sounds like fpgaminer's argument is that biometric keys can't be compromised because of "liveness tests". You're arrested, and the cops hold the phone up to your face to unlock it. That's a pretty big compromise, and there's literally nothing you can do to prevent it.
  - kickling 9y ago
    I heard in another comment in this thread it has focus detection, so you would have to look at the phone for it to unlock. Can not find any other source of this though.
    - djrogers 9y ago
      > Can not find any other source of this though. It's in the marketing materials for the phone, was mentioned multiple times on stage during the introduction, and is in the introduction to the whitepaper that this entire HN thread is about. So yeah - a couple of sources are available...
  - coldtea 9y ago
    The same holds true for physical keys. If you're arrested then the cops can tie you, grab the keys and unlock your door "and there's literally nothing you can do to prevent it.". Also some guy can just make a copy your key (pretty trivial) -- heck people can even break your door bypassing the key altogether.
    - chimeracoder 9y ago
      > The same holds true for physical keys. Nobody's saying that home security is good. The point the parent was making is that, even with a "liveness test", compared to other biometric identification, this is a regression from fingerprint-based authentication for the iPhone.
eeeeeeeeeeeee 9y ago
You turn it off until it's been confirmed secure again. This is not much different from any security issue in software -- you disable the functionality until it's secure again. The only risk is if somebody cracks the entire FaceID model and Apple cannot fix it in software. But even then, you would still disable FaceID and either return your phone or wait for a recall.
- Sir_Cmpwn 9y ago
  You can't replace your face. Are you suggesting that people turn it off until it's secure again meaning, like, plastic surgery?
  - eeeeeeeeeeeee 9y ago
    You can't!? Wow, thanks for teaching me that. Did you even read what I wrote? You would turn off FaceID and revert back to a passcode/passphrase until it is fixed in software.
    - Sir_Cmpwn 9y ago
      Until what's fixed in software? Your face being compromised? You can't fix a leaked secret in software.
      - eeeeeeeeeeeee 9y ago
        You are implying that there is a "secret" based on that face mapping that can be copied out of the device and then used to either 1) gain access to a non-Apple system that has some kind of biometric face detection system or 2) can be used to reproduce a face like yours to unlock your phone without you present From the PDF: "Once it confirms the presence of an attentive face, the TrueDepth camera projects and reads over 30,000 infrared dots to form a depth map of the face, along with a 2D infrared image. This data is used to create a sequence of 2D images and depth maps, which are digitally signed and sent to the Secure Enclave. To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. A portion of the A11 Bionic chip’s neural engine—protected within the Secure Enclave—transforms this data into a mathematical representation and compares that representation to the enrolled facial data. This enrolled facial data is itself a mathematical representation of your face captured across a variety of poses. " So, it's more like a hash of your face, which is very similar to how TouchID works. So, again, even if someone were able to break into the secure enclave and get that data, what could they do with it? It's a representation of yourself that is used for Apple devices. Also, this is an OPTIONAL feature. If it doesn't fit your security model, don't use it. For the same reason a lot of people don't use TouchID -- they want the security of a passphrase. But for 90%+ of people that will buy that phone and are not at risk of the government or police pursuing them, the security it offers is more than adequate and it achieves this by not annoying the user and requiring them to have a 50 character passphrase.
wmertens 9y ago
Tell apple they can only recognize your face if it shows a certain expression

fnl 9y ago

That isn't taking into account how frequent relative to all such target objects an attack occurs. If a (much?) smaller percentage of houses get burglarized vs. number of phones broken into, then security requirements are not really comparable. (Note that I have zero idea of or even guess for the sizes of either, though.)

bagacrap 9y ago

I have a house with a standard lock. A couple years ago someone decided to kick the front door in while I was at work. We have shitty house locks because the entire system is terribly insecure and strengthening one link in the chain is pointless.

deleted 9y ago
[deleted]
KGIII 9y ago
Physical locks just keep honest people honest. Also, OP says you can't lose your biometrics. You can, it's just painful and you'll not be the least bit happy about it.
21 9y ago
There are better doors out there: https://www.youtube.com/watch?v=Bk48kU6fGWc https://www.youtube.com/watch?v=Bk48kU6fGWc

chrisfosterelli 9y ago

> Even with the worst biometrics, your phone would be more secure than 99% of houses. And I don't see people complaining about the state of home security... 1. Many (most?) people have more private information on their phones than they do in their house, and there is different risks of each being compromised, so there should be different standards. 2. My impression of the security community is that pretty much everyone uniformly agrees that home security is garbage and needs to be improved.

solatic 9y ago

> And I don't see people complaining about the state of home security... Home security is a really poor analogy. * Attacking everybody's house at once is not scalable, unlike attacking many people's electronic devices at once. Furthermore, defending against a SWAT team armed with a search warrant is nigh impossible, no matter what lock you put on your front door. * The contents of most people's houses is far more weighted to "things which would be a hassle to file with insurance to replace" and less "it would ruin my life if this got into the wrong hands", and their strategy for home defense is weighted as such. * Many people whose strategy for home defense (well, in the US) is more serious, will weigh more towards weapons / guns and less to the actual locks on the doors. What would a digital equivalent be? A prick of poison for anybody who picks up a phone which doesn't belong to them? The analogy totally breaks down in context.

btown 9y ago
The analogy is one of defense in depth: if you're serious about security, you can use memorized & typed secondary passwords on secure apps, such as secure notes in 1Password, or an app like https://guardianproject.info/apps/pixelknot/ https://guardianproject.info/apps/pixelknot/ that would steganographically encode secure notes into otherwise normal photos, potentially with independent passwords for complete deniability. A locked door and a face-locked iPhone are only the first line of defense, and are largely for convenience's sake in both daily use/as a deterrent and in the case of physically being distant from your property. The "guns" are entirely independent.
- splintercell 9y ago
  I am not a huge fan of Steganography in images. There are far too many services out there which take the liberty of modifying or re-encoding your images to a different format for various reasons. Is there a lossless medium which can be used for steganography?
  - anko 9y ago
    If it's lossless, then where do you hide the message? In "comment" sections? Not very well hidden. How many formats are there where you can intentionally encode something with meaningless characters?

lechiffre10 9y ago

So basically you are saying that a bad biometric that would allow someone to use a face mask and walk into your home easily would still be better than 99% of house keys?

mbgerring 9y ago

It all depends on your threat model. Police are perfectly capable of breaking into my home, but it doesn't matter, because if they do it without a warrant everything they find is inadmissible in court. Whereas with FaceID, if I'm arrested and they point my phone at my face to unlock it against my will, anything they find is now admissible as evidence.

wmertens 9y ago
I keep hoping that FaceID will also get FacePassword, where you have to show one or more expressions in order. Then it becomes a password, and the police can't force you to change your expression.
- dragonwriter 9y ago
  To the extent the police can legally compel you to provide access to a device, the means by which that access is protected does not impede their legal capability to do it and impose consequences for non-compliance.
  - mbgerring 9y ago
    That's the thing -- the police can't legally compel you to provide them access to your device, but if they can get it without you having to give them anything, by, say, pointing the phone at your face, it's fair game. I don't have time to look up the court precedents about this, but that's my understanding of the current state of the law.
    - dragonwriter 9y ago
      I misread the upthread comment as implying that FaceID “passwords” were more legally secure than regular passwords, not just more legally secure than plain FaceID. I agree that the description you provide is generally correct.
    - jsjohnst 9y ago
      > the police can't legally compel you to provide them access to your device Your understanding of the current state of the law is very wrong. There's a person in the US [0] who has been in jail for multiple years now without being tried / convicted due to refusing to provide access to their devices. There's another case with a warrant[1] allowing an officer to force someone to unlock their phone protected by TouchID. I have also heard multiple US states have enacted laws specifically addressing device unlock, but I don't have links to them at the moment. [0] https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-years-for-refusing-to-decrypt-drives-will-he-ever-get-out/ https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-ye... [1] http://files.cloudprivacy.net/la-iphone-fingerprint-warrant.pdf http://files.cloudprivacy.net/la-iphone-fingerprint-warrant....

ct0 9y ago

The username is the face, the password is the pattern of blinking or a unique expression the user displays to the camera.

ecesena 9y ago

The problem with biometrics is not username vs password, biometrics are password. The problem is that these are client-side protections, and there's no data sent to a server that can verify the identity. And you can't build a remote identity verification with this data, because there's no way for the user to change it and revoke it (let alone it's very privacy sensitive). The biometric access control systems (the one "in the movies", palm recognition, retina scanners...) implicitly assume that the connection between the sensor and the central server is secure, and that the user authorized it's data to be in the database. This model doesn't apply to "general users" and "internet companies". Research in biometric security aims at finding functions of your biometric data that can be revoked and it's not privacy sensitive. Edit: with "revoke" I don't mean remove it. I mean revoke one and set another one, like you can do for a password/pin, or for a phone number/hw device.

deleted 9y ago
[deleted]
Fnoord 9y ago
> The problem with biometrics is not username vs password, biometrics are password. Yes, that is the problem. No, biometrics are not password. Please stop spouting this nonsense? Biometrics are akin to username; they suggest your identity, but don't authenticate you. They should not be used as password because they cannot be changed, and cannot be kept secret. A password (or better, TOTP authentication) can be changed, and can be kept secret; a hardware fingerprint scanner (or face or iris scanner) cannot be changed, and can be faked by any semi-intelligent person or organization. Fingerprint can already be stolen and used in identity theft. We saw this various years ago in CCC when a German minister got his/her fingerprints stolen as a way to prove the insecurity. It is only a matter of time when the common people learn about how to trick face recognition and iris recognition. In the meantime, strong passwords and (preferably) TOTP is secure. Use that instead. > Research in biometric security aims at finding functions of your biometric data that can be revoked and it's not privacy sensitive. Cat and mouse game, and wrong premise: biometrics cannot be revoked. They're permanent.
- dkonofalski 9y ago

ramses0 9y ago

Very important point (re: house key analogy). Houses and cars are 1000% not secure, you can always break a window and get access. That's why they have ARMORED cars and bank VAULTS or safes. However, if you break a window, or drill a hole in a safe, there is "visible sign of forced entry". https://en.wikipedia.org/wiki/Forcible_entry https://en.wikipedia.org/wiki/Forcible_entry When you see a broken window by your front door, when you see a broken window on your car, when you see a hole cut through sheetrock next to your door, or you see your door blasted off it's hinges, you know that the security of the device has been compromised. That's truly what's missing on device security nowadays: "Signs of Forced Entry" ... number of incorrect password attempts, number of incorrect FaceID / TouchID attempts, etc. And if your device is rooted or untrusted, then there's often not a good, trusted, visible way to see that security has been actually compromised (as opposed to attempted to be compromised).

Osmium 9y ago
You raise very good points, but it's not like there aren't ways to break into a house without signs of forced entry. To my mind, privacy is often the most important difference. There are a lot more private things on my phone than in my house, honestly -- a phone these days is often almost an extension of the mind. Which is why we should hold it to a higher standard. I personally have no problems with TouchID/FaceID, I think the secure enclave is great, but I still think there's a lot of room for improvement, better sandboxing of data, better tripwires for when data is accessed/transferred, etc.

mtgx 9y ago

> your biometrics can't be easily stolen, and you can't lose them. Fingerprints are very different from face. Someone has to actually follow you around and clone your fingerprint from something you touched. With facial unlock, as virtually all previous systems have demonstrated, you usually only need someone's online photo, or a close variation of that to unlock a device/system that uses face unlock. With everyone plastering their photos in high resolution all over the web these days, and with machine learning advancing so fast these days, how long until a system like this is defeated? Do you really think "3D photos" of you can't be created? Or even ones that test for "liveness". What exactly do you think that "liveness test" is? It's just an algorithm that Apple uses. That algorithm can be reverse-engineered. Also, Apple's Face ID has a False Acceptance Rate of 1 million versus TouchID "only" 50,000, is very misleading. That metric only works when you think of an attacker throwing completely random faces at the system. Do you think an attacker that wants your phone is going to throw random faces at the device? Or do you think it's far more likely that it will start building that 3D profile out of your high-resolution online photos? Suddenly that 1 million FAR becomes much smaller, as the difference in profile from what the attacker has already gathered on you from public websites is much smaller than how you look like in real life. This is what may actually make the Face ID system less secure overall than TouchID. It's just way way easier to get someone's pictures than it is to get their fingerprints.

a_t48 9y ago
> Do you really think "3D photos" of you can't be created? Or even ones that test for "liveness". What exactly do you think that "liveness test" is? It's just an algorithm that Apple uses. That algorithm can be reverse-engineered. I believe it was doing infrared detection.

greendude29 9y ago

This is farcical.

post_break 9y ago

My twin can't use his house key to get into my house.

jdavis703 9y ago

The thing is I'm not really too concerned about my home's physical security (I lock the door, but the entire attack surface area is too large for my risk profile to lock it down extensively). If the cops want to search my house, they can kick the door in. If a thief wants to take something they can break a window. If a fraudster wants to trick my landlord into letting them in they could do so. As a result truly important property and information is fully secured using passcodes and pin numbers.

Fnoord 9y ago

Its more nuanced than you put it with physical keys. Consider for a moment the baklava [1]. A baklava increases anonymity of an attacker (ie. burglar in our discussion), but also increases suspiciousness of victims and 3rd parties (ie. innocent bystanders, witnesses). Physical burglary has many of these nuances, trade-offs. A key on a front door is meant to keep an attacker out for as long as they get caught and/or identified, or become afraid they get caught and/or identified. It isn't meant to stop an attacker to enter a house. If an attacker wants to enter your house, they can just break in via a window. Various techniques exist for that, some are noisy, others are more sophisticated and aren't noisy. Someone who's trying to enter via a window by night though is suspicious which means the attacker might be noticed and get caught. Most normal house keys [at least here in NL] are very cheap and have a lot of vulnerabilities, they have weak entropy (e.g. 6 entries with 6 options each), or are vulnerable via lock bumping (takes max 10 sec to enter and doesn't look very suspicious). With electronic devices, its more binary, but it depends a lot on whom you're defending against. Petty criminals, technical criminals, or state actors. > This is in contrast to passwords and pincodes, which can be stolen by eyeballs, cameras, audio recording devices, etc. Yes, passwords can be stolen by eyeballs and cameras and Van Eck phreaking (TEMPEST). However if combined with TOTP it becomes something you have and something you know. Facial recognition is just a form of something you have, and the key cannot be changed. They key can be put off, but that is not more secure than having TOTP on your watch (with yes/no button) and being able to disable the authentication method on your phone by pressing the power button 5 times. Liveness is just obscurity. Its gonna be insecure at some point, and you'll be begging Apple for a newer, more secure solution at that point. Pray they still support your advice by then. [1] Yes, thank you, balaclava (bivakmuts in my primary language). I have difficulty pronouncing and remembering the word. I'll keep it as-is for readability of the discussion, and for admitting my mistake.

anamexis 9y ago
Note - I think you mean balaclava. Baklava is a delicious Greek dessert.

test001only 9y ago

You can refuse to give out a password or claim you forgot, but with biometrics there is not much of an option.