7 ms·

this appears to be a trick of sorts. according to a comment by one of the brothers, faceid only acknowledged the new user after the phone had been unlocked via

by tribby 9y ago

this appears to be a trick of sorts. according to a comment by one of the brothers, faceid only acknowledged the new user after the phone had been unlocked via PIN while looking at it. that sounds a bit like an intentional feature for training the facial recognition?

freeflight 9y ago
Yup pretty much, the phone seems to learn appearance changes when the PIN is used to unlock. They also look quite similar except for 1-2 moles and the different hairstyles. But they have really similar head shapes and facial structures, wearing the same brand of glasses certainly ain't helping either.
Hates_ 9y ago
For those who don't want to wade through the comments: > We wanted to give an update on this, since we have had some time to play around with the phone a bit. And this is whats happening. I did not realize what exact steps we had followed until it happened again today. We have been resetting face id and doing it all over again. And this is what the steps are that makes it happen almost 50% of the time. Not sure if its intended or is a bug. 1. My brother(left) setup the face id. 2. Unlocks with his face. Does not with mine. 3. I entered the pin with the phone facing me. It it unlocked as expected. 4. Now I locked it again. 5. I raised it up to my face, and it unlocks. 6. It unlocks each time after that with my face
sudhirj 9y ago
This is super important info that they've left out of the video. A face similar to the face on file that has the PIN should be considered a face capable of unlocking, I think. Everyone's face changes over time.
- trothamel 9y ago
  At the same time, the system needs to be judged as to if it's secure or not, not if it's the best possible implementation of FaceID or not. After all, something like a fingerprint reader on the back is a valid alternative. At the end of the day, a system where it's likely you'll find someone who can unlock it isn't very secure.
  - scarface74 9y ago
    It didn't just unlock based on a similar face. It unlocked for someone who had a similar face and knew the correct PIN. FaceID learns about changes in your looks based partially on those criteria. If the other person knows your PIN, you've already loss.
lttlrck 9y ago
What happens when an untrusted person that uses your PIN on a regular basis for legitimate reasons becomes untrusted? Now you need to reset your PIN and retrain FaceID? I hope IOS gives a warning when changing the PIN that if you think FaceID has been compromised to retrain FaceID. edit: because the idea that FaceID could be compromised like this is non-obvious
- skywhopper 9y ago
  Sounds like it will only happen if the faces are similar. So if the threshold for matching is 95% match to the internal model, but the faces are 90% similar, and then the new face enters the correct PIN, then the new face will be used to tweak the model, which will move the error to inbetween the features of both. So if their faces are similar to within twice the margin-of-error of the detection algorithm, then you can probably get this effect. All that said "an untrusted person that uses your PIN" knows your PIN... so they are a trusted person as far as the OS is concerned. There's nothing you can do with FaceID/TouchID that you can't do with the PIN. All FaceID/TouchID do is decrypt the PIN from the secure enclave. So if you've shared your PIN with them, then this is a weird thing, but not actually a security violation.
  - dTal 9y ago
    The difference is that it's easy to change a PIN, but hard to retrain FaceID. So sharing a PIN is reasonable in the knowledge that it can be changed, but you might not be aware that it has more ramifications under opaque and unclear circumstances.
    - zwily 9y ago
      Retraining FaceID takes about 20 seconds. How is that hard?
      - ProblemFactory 9y ago
        The hardest part might be noticing in the first place that your FaceID model has drifted away from only your face.
Spooky23 9y ago
It’s also similar to fingerprint behavior — you could add multiple people’s prints to your phone.

by tribby 9y ago

freeflight 9y ago

Yup pretty much, the phone seems to learn appearance changes when the PIN is used to unlock. They also look quite similar except for 1-2 moles and the different hairstyles. But they have really similar head shapes and facial structures, wearing the same brand of glasses certainly ain't helping either.

Hates_ 9y ago

For those who don't want to wade through the comments: > We wanted to give an update on this, since we have had some time to play around with the phone a bit. And this is whats happening. I did not realize what exact steps we had followed until it happened again today. We have been resetting face id and doing it all over again. And this is what the steps are that makes it happen almost 50% of the time. Not sure if its intended or is a bug. 1. My brother(left) setup the face id. 2. Unlocks with his face. Does not with mine. 3. I entered the pin with the phone facing me. It it unlocked as expected. 4. Now I locked it again. 5. I raised it up to my face, and it unlocks. 6. It unlocks each time after that with my face

sudhirj 9y ago

This is super important info that they've left out of the video. A face similar to the face on file that has the PIN should be considered a face capable of unlocking, I think. Everyone's face changes over time.

trothamel 9y ago
At the same time, the system needs to be judged as to if it's secure or not, not if it's the best possible implementation of FaceID or not. After all, something like a fingerprint reader on the back is a valid alternative. At the end of the day, a system where it's likely you'll find someone who can unlock it isn't very secure.
- scarface74 9y ago
  It didn't just unlock based on a similar face. It unlocked for someone who had a similar face and knew the correct PIN. FaceID learns about changes in your looks based partially on those criteria. If the other person knows your PIN, you've already loss.

lttlrck 9y ago

What happens when an untrusted person that uses your PIN on a regular basis for legitimate reasons becomes untrusted? Now you need to reset your PIN and retrain FaceID? I hope IOS gives a warning when changing the PIN that if you think FaceID has been compromised to retrain FaceID. edit: because the idea that FaceID could be compromised like this is non-obvious

skywhopper 9y ago
Sounds like it will only happen if the faces are similar. So if the threshold for matching is 95% match to the internal model, but the faces are 90% similar, and then the new face enters the correct PIN, then the new face will be used to tweak the model, which will move the error to inbetween the features of both. So if their faces are similar to within twice the margin-of-error of the detection algorithm, then you can probably get this effect. All that said "an untrusted person that uses your PIN" knows your PIN... so they are a trusted person as far as the OS is concerned. There's nothing you can do with FaceID/TouchID that you can't do with the PIN. All FaceID/TouchID do is decrypt the PIN from the secure enclave. So if you've shared your PIN with them, then this is a weird thing, but not actually a security violation.
- dTal 9y ago
  The difference is that it's easy to change a PIN, but hard to retrain FaceID. So sharing a PIN is reasonable in the knowledge that it can be changed, but you might not be aware that it has more ramifications under opaque and unclear circumstances.
  - zwily 9y ago
    Retraining FaceID takes about 20 seconds. How is that hard?
    - ProblemFactory 9y ago
      The hardest part might be noticing in the first place that your FaceID model has drifted away from only your face.

Spooky23 9y ago

It’s also similar to fingerprint behavior — you could add multiple people’s prints to your phone.