3 ms·

"Can they reasonably steal a full perfect 3D map of your face that can pass the attention checks and whatever FaceID uses to determine its you?" Plenty of phon

"Can they reasonably steal a full perfect 3D map of your face that can pass the attention checks and whatever FaceID uses to determine its you?" Plenty of phones and cameras have 3D capability. That kind of tech is already being used in cosmetology courses to 3D print a model of your own face and hair for hairstyling practice. It wouldn't be that difficult to make a warm 3D mask to fool the infrared camera and sensors.

MBCook 9y ago
But how close do you have to get to use that 3D capability? And is its resolution as good or better than what Apple is using? I mean sure you can knock someone out and use a handheld 3D scanner to get a whole bunch of good shots of them but that’s hardly someone walking down the street and you getting a quick grab of their face. My point isn’t that it’s impossible it’s that it’s not feasible for any normal person or group without a large and noticeable undertaking. These are not reasonable threat models for normal people.
- lightedman 9y ago
  "But how close do you have to get to use that 3D capability?" With a Lytro camera you could do it from just about any distance. "but that’s hardly someone walking down the street and you getting a quick grab of their face." All you have to do is even look remotely interested in your phone and pretend you're not taking a picture - boom info gotten surreptitiously. That's assuming the other person you're copying biometrics from is even paying attention - odds are they're probably too focused on their own phone to notice.
URSpider94 9y ago
I think you are oversimplifying. The IR camera isn’t detecting “warm” (it’s not a FLIR camera), it’s detecting color in the IR range, which is going to be extremely characteristic of a face. In addition, a mask may copy appearance, but it’s not going to copy physical shape in detail. Finally, the channel between the sensor and secure enclave is likely encrypted and/or authenticated, so you can’t just inject any depth image.
- lightedman 9y ago
  "it’s detecting color in the IR range," A very narrow bandwidth of IR thanks to what we term the "Infrared Window," which is trivially easy to duplicate or fool, as it's one of the same IR bands used for surface mineralogy done via satellite. I'm really not oversimplifying at all; I am applying knowledge in fields in which I am competent to say "You think it can't be that easy, here's how easy it can really be."

MBCook 9y ago

But how close do you have to get to use that 3D capability? And is its resolution as good or better than what Apple is using? I mean sure you can knock someone out and use a handheld 3D scanner to get a whole bunch of good shots of them but that’s hardly someone walking down the street and you getting a quick grab of their face. My point isn’t that it’s impossible it’s that it’s not feasible for any normal person or group without a large and noticeable undertaking. These are not reasonable threat models for normal people.

lightedman 9y ago
"But how close do you have to get to use that 3D capability?" With a Lytro camera you could do it from just about any distance. "but that’s hardly someone walking down the street and you getting a quick grab of their face." All you have to do is even look remotely interested in your phone and pretend you're not taking a picture - boom info gotten surreptitiously. That's assuming the other person you're copying biometrics from is even paying attention - odds are they're probably too focused on their own phone to notice.

URSpider94 9y ago

I think you are oversimplifying. The IR camera isn’t detecting “warm” (it’s not a FLIR camera), it’s detecting color in the IR range, which is going to be extremely characteristic of a face. In addition, a mask may copy appearance, but it’s not going to copy physical shape in detail. Finally, the channel between the sensor and secure enclave is likely encrypted and/or authenticated, so you can’t just inject any depth image.

lightedman 9y ago
"it’s detecting color in the IR range," A very narrow bandwidth of IR thanks to what we term the "Infrared Window," which is trivially easy to duplicate or fool, as it's one of the same IR bands used for surface mineralogy done via satellite. I'm really not oversimplifying at all; I am applying knowledge in fields in which I am competent to say "You think it can't be that easy, here's how easy it can really be."