17 ms·

As a consumer this doesn't worry me as to be able to crack my phone it looks like they would already have to have access to my face to make the mask (and an exp

As a consumer this doesn't worry me as to be able to crack my phone it looks like they would already have to have access to my face to make the mask (and an expert sculpture to make a nose). If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance in the outdoors then I think we'd have reason to be worried. For spies, spooks, government agents etc. I suspect that Face ID would always be a no-no as it is much harder to control the ability of others to eavesdrop.

jonwinstanley 9y ago
Exactly. This is definitely not a reason not to buy an iPhone X.
nvr219 9y ago
yeah this is mostly like, multinational CEOs, etc who would be targeted
- azinman2 9y ago
  And they shouldn’t rely on consumer-level security protection.
  - Spivak 9y ago
    You say that like they don't all use commodity phones and laptops. The idea that people are buying super secure hardware for CEOs is firmly in the realm of screenplays.
    - azinman2 9y ago
      I didn’t say they shouldn’t use an iPhone, I said they shouldn’t use consumer level security features. All leading smartphones have enterprise features that change the security profile — for example to use long alphanumeric passwords instead of a PIN or FaceID.
Arnt 9y ago
Remember: Attacks always grow better, not worse. The bluetooth distance records grew quite quickly.
- valuearb 9y ago
  Apple could add eye movement to it's algorithm tomorrow and this attack would fail forever.
  - Arnt 9y ago
    Oh sure. Unreleased vapourware beats all attacks.
    - valuearb 9y ago
      Isn't this attack "unreleased vaporware"? For example, you have to use FaceID every 4 hours or it requires a passcode. Do you think they were able to hand make an acceptable mask within 4 hours?
      - detaro 9y ago
        Do they have to start making the mask after obtaining the phone?
      - Arnt 9y ago
        It's not vapourware: It may be a lie, but it's not a promise of greatness in some future version. They're saying "we have carried out an attack", not "we will attack oh-so-well". Regarding the four-hour limit, the attacker have to either cheat and start making the mask in advance, or practise making masks quickly. Neither seems impossible. But of course, Apple could (and IMO would) improve the defense. I'm sure Apple would think of ways to counter any publicly known attack.
dsfyu404ed 9y ago
Two words: incremental improvement. 3d printing is getting better and cheaper all the time. Cameras and software are getting better all the time. If someone cares enough to invest the R&D it should be pretty easy to automate everything between getting photos someone and printing the mask. The point is that using biometric authentication as an all-in-one isn't secure.
- simonh 9y ago
  Photos are not enough, they would need a high resolution 3D scan on the person’s face as well. Also they didn’t just use 3D printing, they had to use different fabrication methods and materials for different parts of the face part of which was ‘simply’ hand sculpted. This is not at all trivial to automate. But then we already know it’s not as secure as two factor authentication and a random passcode. Touch ID could be fooled with predict fingerprints as well, though with the deep subcutaneous scanning in later versions it was much harder than with the first version. Anyway, Nobody who critically depends on the security of their phone should use Face ID or Touch ID anyway.
  - blensor 9y ago
    Why do you know that photos are not enough? If you have good enough photos you can produce higher resolution 3D models than with a Kinect like depth sensor (which in the end is just a stereo "camera" anyway). And since the Face ID probably does not work with any arbitrary 3D object but only with faces you just need to reconstruct the target face to a degree so that the Face ID system can detect the landmarks it is looking for. My guess on how those attacks will develop in the future are: 1. Exploit occlusions. As far as I know the FaceID System does work with occluded faces (glasses, maybe scarfs in the winter, ...). Once you know what the minimum required visible area is, you can focus on partial faces. If the algorithm has less features to identify, it probably makes more mistakes and is easier to fool. 2. Create a low-dimensional (in terms of parameters, not vertices) representation of a face that can be tuned to mimic a wide variety of target faces and still is correctly identified by Face ID. Once you have that you can take a few photos of your target person and tune the parameters in your generic model to fit the person in the photos, and probably be even able to reconstruct a mask from far away. 3. Try to create a real mask with a flexible surface that can be tuned to fit a wide range of faces. If at all possible try to span the same feature space as in 2.) as it would allow you to create a real face mask from only the few parameters that directly come from your fitting process. If all of the above works an attacker can create an Iphone stealing pipeline: Have several cameras set up in a crowded tourist spot. Match persons in different views and try to reconstruct their faces. Once the system has found a person that has been viewed from enough angles, "retrieve" his phone unlock it with the mask and reset it. I know that does sound pessimistic, but your face is a "security token" but one which you can not realistically protect from theft. Unless you want it to have serious negative impact on your daily routine. And if someone wants to hide his face while in public (i.e. with a surgical mask), he can no longer travel to certain countries. I live in Austria and there just recently came a law into effect that bars everyone from occluding their face while in public.
M4v3R 9y ago
Also, it took them a whole week to achieve this. So this is definitely not something someone could realistically do to you unless you are a some sorts of high-profile target.
- coldtea 9y ago
  Or you know, have access to a $300 3D printer, a $200 real one, is idle (e.g. unemployed), and can expect to make $2000 or more from stealing your phone/identity details etc.
arrrg 9y ago
It seems much more secure than fingerprints, since that was defeated much more quickly (within a couple days?), with easily lifted prints and a more cost effective (though still somewhat lengthy) method. This, in comparison, seems much harder and consequently further reduces the realistic attack scenarios where people have to be worried. For most people this is a non-issue. (It mostly already was a non-issue with fingerprints, for the same reasons.)
- mtgx 9y ago
  TouchID was spoofed in 2 days and FaceID in 7 days. Still, I feel like the difference in time is not that relevant. I think the biggest difference in time was given by the "attacker" trying to understand what the FaceID system is looking for exactly, as an algorithm. But once they know that, future attacks should be much faster. Like if they try to bypass someone else's phone, it shouldn't take another 7 days. It could even be hours. With TouchID they already knew what to do - clone someone's fingerprint. There's no machine learning algorithm that needs to be reverse-engineered there.
  - coldtea 9y ago
    >I think the biggest difference in time was given by the "attacker" trying to understand what the FaceID system is looking for exactly, as an algorithm. But once they know that, future attacks should be much faster Not necessarily, as the algorithm is a NN (IIRC), so it looks for different things on different people too.
    - cipherzero 9y ago
      Even easier perhaps, with all the news about adversarial networks lately!
skgoa 9y ago
It's definitely a better situation than an attacker being able to steal your fingerprint off a glas or other everyday object. Copying a fingerprint requires very little skill.
- sambeau 9y ago
  I thought you needed a 3D fingerprint to fool an iPhone—a holding from an impression in clay rather than a spear on a window.
  - StavrosK 9y ago
    Yes, but fingerprints are trivially 3D, one part is just slightly recessed.They can be easily reconstructed from a 2D photo.
  - Tepix 9y ago
    No, you can put a thin printed 2d fingerprint onto your finger to fool it.
    - zionic 9y ago
      This isn't true, touchID requires a living person/something that simulates a living person to unlock.
      - schrodinger 9y ago
        Isn’t that why they said to put it on you finger?
      - gizmodo59 9y ago
        Interesting. Can you point to any official white-paper from Apple claiming this? I'm reading this: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf but I cannot find any such information about a living person.
matwood 9y ago
Another thing is that an attacker only gets a few chances to use the face unlock before the phone requires a pin. How many tries did it take them while having to re-enable FaceId after locking the phone? IMO, it's only 'broken' if they can get the face right the first time without causing the phone to lock itself.
- IgorPartola 9y ago
  Hmm. I read somewhere that if FaceID doesn’t work and you use the PIN, it adds the face to the dataset. Is it possible they just slowly worked the mask into the dataset?
  - cardamomo 9y ago
    Doesn't sound like they took that approach: > However, we knew about this "learning", thus, to give a more persuasive result, we applied the strict rule of "absolutely no passcode" when crafting the mask.
    - michaelmior 9y ago
      I was confused by this at first. I thought one of the concerns was the the algorithm would be more discerning about the real face over time. It doesn't seem as though they've addressed this issue.
    - coldtea 9y ago
      Then again, if they wanted to make a name for their selves with BS, they would say that even if they have done the opposite.
    - Infernal 9y ago
      How did they accomplish this though? Is there a timeout where, after enough FaceID failures cause a fallback to passcode, FaceID is accepted again without entering a passcode in the interim?
  - matwood 9y ago
    That's not what I'm saying. They made a face that managed to trick the FaceId, but how many times did they have to test it? In a real world situation, the face would have to work in 3 tries or the phone locks itself with a passcode. Given the elaborate process they went through to make the face, it would be very hard to make a face that basically works the first time (I've noticed FaceId will try multiple times and lock pretty quickly).
sandworm101 9y ago
>> For spies, spooks, government agents etc. I suspect that Face ID would always be a no-no You are correct. Face recognition, like any other biometric, is a bit of a farce. The face doesn't unlock the phone. The face is read by software which then generates some string of numbers, essentially a hash of the face/print, than then unlocks the phone. That hashing process can be hacked/intercepted/replicated just as with any other password. Biometrics is a convenience feature, not security device. But the real reason that biometrics aren't used in highly secure environments it the difficulty of repudiation. If/when a break-in does occur, how exactly does everyone reset their faces? It's like asking everyone to reset their passwords and everyone then using the same passwords. What you have to do is install a new hashing regime and rescan everyone's faces. The best system, the one that is used most everywhere, is three-factor: (1) A card you carry/scan. (2) A password/code you enter into a pad. (3) An old man behind glass, usually a retired soldier, who has been in the job for years and knows everyone in the building. That old man can recognize people better than any biometric scanner.
- dhosek 9y ago
  Very important note: Be sure to provide the old man behind glass with food and water. I had an old man behind glass in my house for security and didn't think to give him food and water and he died within a week.
amelius 9y ago
> If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance A scanner could be placed e.g. behind or on top of a mirror in a restroom.
- sambeau 9y ago
  Presumably all you would need is another iPhone X to do the scanning.
  - amelius 9y ago
    Yes, but Apple probably has locked down the scanner.
  - schrodinger 9y ago
    The data from one iPhone isn’t supposed to be useful to another since the infrared emitters are in a random pattern.
    - coldtea 9y ago
      It doesn't need to be usable to another iPhone for what we're discussing in this subthread. Just to be usable to map the face in 3D space and make a mask.
cvsh 9y ago
>If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance in the outdoors then I think we'd have reason to be worried. I would be astonished if state actors are not already well on their way to figuring out how to do this.
- 7Z7 9y ago
  >For spies, spooks, government agents etc. I suspect that Face ID would always be a no-no as it is much harder to control the ability of others to eavesdrop.
- acdha 9y ago
  That's true but it's outside the threat model for most devices: that same state-level actor can no doubt use cameras to collect passwords and some combination of imaging and subterfuge to get fingerprints, too.
coldtea 9y ago
>As a consumer this doesn't worry me as to be able to crack my phone it looks like they would already have to have access to my face to make the mask So like what they can gather from 100s of one's photos in social media and other places?
- abritinthebay 9y ago
  This assumes a lot. As the OP said: demonstrate that from that data you can produce a sufficiently accurate model that works with this method. The article hasn’t. It may be possible (you only have to match the resolution of the IR depth map) but it is not currently demonstrated. Plus I imagine it’s quite easy to refine FaceID in the software as well so an attack like this may not be very long lasting.
  - sillysaurus3 9y ago
    Attacks only get better with time. Check back in a couple years and someone may have done just that.
    - abritinthebay 9y ago
      Defenses only get better with time too. That isn’t a good argument. Based on that logic we should have no security ever on anything because it’s always pointless long term.
- luxuryballs 9y ago
  they also have to gain physical access to your device, so if you're that worried about it, don't use FaceID or do the 'squeeze lock' to disable FaceID and require your passcode for the next unlock before you go to bed or something
Spooky23 9y ago
For a consumer, it's fine -- way better than the bullshit passwords that people use. Once you start getting into higher security areas, you still need multiple identity factors to authenticate people. I'd guess that a bigger potential risk factor for systems like FaceID is intent -- entry of a passcode or fingerprint being placed on a button is a more explicit expression of intent as opposed to glancing at a device.
colordrops 9y ago
So the TSA? https://news.ycombinator.com/item?id=15684139 https://news.ycombinator.com/item?id=15684139
randyrand 9y ago
To make a 3d mask you don't need a 3d scan. You just need a few photographs from different angles and off the shelf photogrammetry software. These scans were made from photographs: http://2.bp.blogspot.com/-c_lP5_5u1Dk/VmM5aDNFHzI/AAAAAAAABzo/H6a24Fdd3Yk/s1600/test1.jpg http://2.bp.blogspot.com/-c_lP5_5u1Dk/VmM5aDNFHzI/AAAAAAAABz...

jonwinstanley 9y ago

Exactly. This is definitely not a reason not to buy an iPhone X.

nvr219 9y ago

yeah this is mostly like, multinational CEOs, etc who would be targeted

azinman2 9y ago
And they shouldn’t rely on consumer-level security protection.
- Spivak 9y ago
  You say that like they don't all use commodity phones and laptops. The idea that people are buying super secure hardware for CEOs is firmly in the realm of screenplays.
  - azinman2 9y ago
    I didn’t say they shouldn’t use an iPhone, I said they shouldn’t use consumer level security features. All leading smartphones have enterprise features that change the security profile — for example to use long alphanumeric passwords instead of a PIN or FaceID.

Arnt 9y ago

Remember: Attacks always grow better, not worse. The bluetooth distance records grew quite quickly.

valuearb 9y ago
Apple could add eye movement to it's algorithm tomorrow and this attack would fail forever.
- Arnt 9y ago
  Oh sure. Unreleased vapourware beats all attacks.
  - valuearb 9y ago
    Isn't this attack "unreleased vaporware"? For example, you have to use FaceID every 4 hours or it requires a passcode. Do you think they were able to hand make an acceptable mask within 4 hours?
    - detaro 9y ago
      Do they have to start making the mask after obtaining the phone?
    - Arnt 9y ago
      It's not vapourware: It may be a lie, but it's not a promise of greatness in some future version. They're saying "we have carried out an attack", not "we will attack oh-so-well". Regarding the four-hour limit, the attacker have to either cheat and start making the mask in advance, or practise making masks quickly. Neither seems impossible. But of course, Apple could (and IMO would) improve the defense. I'm sure Apple would think of ways to counter any publicly known attack.

dsfyu404ed 9y ago

Two words: incremental improvement. 3d printing is getting better and cheaper all the time. Cameras and software are getting better all the time. If someone cares enough to invest the R&D it should be pretty easy to automate everything between getting photos someone and printing the mask. The point is that using biometric authentication as an all-in-one isn't secure.

simonh 9y ago
Photos are not enough, they would need a high resolution 3D scan on the person’s face as well. Also they didn’t just use 3D printing, they had to use different fabrication methods and materials for different parts of the face part of which was ‘simply’ hand sculpted. This is not at all trivial to automate. But then we already know it’s not as secure as two factor authentication and a random passcode. Touch ID could be fooled with predict fingerprints as well, though with the deep subcutaneous scanning in later versions it was much harder than with the first version. Anyway, Nobody who critically depends on the security of their phone should use Face ID or Touch ID anyway.
- blensor 9y ago
  Why do you know that photos are not enough? If you have good enough photos you can produce higher resolution 3D models than with a Kinect like depth sensor (which in the end is just a stereo "camera" anyway). And since the Face ID probably does not work with any arbitrary 3D object but only with faces you just need to reconstruct the target face to a degree so that the Face ID system can detect the landmarks it is looking for. My guess on how those attacks will develop in the future are: 1. Exploit occlusions. As far as I know the FaceID System does work with occluded faces (glasses, maybe scarfs in the winter, ...). Once you know what the minimum required visible area is, you can focus on partial faces. If the algorithm has less features to identify, it probably makes more mistakes and is easier to fool. 2. Create a low-dimensional (in terms of parameters, not vertices) representation of a face that can be tuned to mimic a wide variety of target faces and still is correctly identified by Face ID. Once you have that you can take a few photos of your target person and tune the parameters in your generic model to fit the person in the photos, and probably be even able to reconstruct a mask from far away. 3. Try to create a real mask with a flexible surface that can be tuned to fit a wide range of faces. If at all possible try to span the same feature space as in 2.) as it would allow you to create a real face mask from only the few parameters that directly come from your fitting process. If all of the above works an attacker can create an Iphone stealing pipeline: Have several cameras set up in a crowded tourist spot. Match persons in different views and try to reconstruct their faces. Once the system has found a person that has been viewed from enough angles, "retrieve" his phone unlock it with the mask and reset it. I know that does sound pessimistic, but your face is a "security token" but one which you can not realistically protect from theft. Unless you want it to have serious negative impact on your daily routine. And if someone wants to hide his face while in public (i.e. with a surgical mask), he can no longer travel to certain countries. I live in Austria and there just recently came a law into effect that bars everyone from occluding their face while in public.

M4v3R 9y ago

Also, it took them a whole week to achieve this. So this is definitely not something someone could realistically do to you unless you are a some sorts of high-profile target.

coldtea 9y ago
Or you know, have access to a $300 3D printer, a $200 real one, is idle (e.g. unemployed), and can expect to make $2000 or more from stealing your phone/identity details etc.

arrrg 9y ago

It seems much more secure than fingerprints, since that was defeated much more quickly (within a couple days?), with easily lifted prints and a more cost effective (though still somewhat lengthy) method. This, in comparison, seems much harder and consequently further reduces the realistic attack scenarios where people have to be worried. For most people this is a non-issue. (It mostly already was a non-issue with fingerprints, for the same reasons.)

mtgx 9y ago
TouchID was spoofed in 2 days and FaceID in 7 days. Still, I feel like the difference in time is not that relevant. I think the biggest difference in time was given by the "attacker" trying to understand what the FaceID system is looking for exactly, as an algorithm. But once they know that, future attacks should be much faster. Like if they try to bypass someone else's phone, it shouldn't take another 7 days. It could even be hours. With TouchID they already knew what to do - clone someone's fingerprint. There's no machine learning algorithm that needs to be reverse-engineered there.
- coldtea 9y ago
  >I think the biggest difference in time was given by the "attacker" trying to understand what the FaceID system is looking for exactly, as an algorithm. But once they know that, future attacks should be much faster Not necessarily, as the algorithm is a NN (IIRC), so it looks for different things on different people too.
  - cipherzero 9y ago
    Even easier perhaps, with all the news about adversarial networks lately!

skgoa 9y ago

It's definitely a better situation than an attacker being able to steal your fingerprint off a glas or other everyday object. Copying a fingerprint requires very little skill.

sambeau 9y ago
I thought you needed a 3D fingerprint to fool an iPhone—a holding from an impression in clay rather than a spear on a window.
- StavrosK 9y ago
  Yes, but fingerprints are trivially 3D, one part is just slightly recessed.They can be easily reconstructed from a 2D photo.
- Tepix 9y ago
  No, you can put a thin printed 2d fingerprint onto your finger to fool it.
  - zionic 9y ago
    This isn't true, touchID requires a living person/something that simulates a living person to unlock.
    - schrodinger 9y ago
      Isn’t that why they said to put it on you finger?
    - gizmodo59 9y ago
      Interesting. Can you point to any official white-paper from Apple claiming this? I'm reading this: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf but I cannot find any such information about a living person.

matwood 9y ago

Another thing is that an attacker only gets a few chances to use the face unlock before the phone requires a pin. How many tries did it take them while having to re-enable FaceId after locking the phone? IMO, it's only 'broken' if they can get the face right the first time without causing the phone to lock itself.

IgorPartola 9y ago
Hmm. I read somewhere that if FaceID doesn’t work and you use the PIN, it adds the face to the dataset. Is it possible they just slowly worked the mask into the dataset?
- cardamomo 9y ago
  Doesn't sound like they took that approach: > However, we knew about this "learning", thus, to give a more persuasive result, we applied the strict rule of "absolutely no passcode" when crafting the mask.
  - michaelmior 9y ago
    I was confused by this at first. I thought one of the concerns was the the algorithm would be more discerning about the real face over time. It doesn't seem as though they've addressed this issue.
  - coldtea 9y ago
    Then again, if they wanted to make a name for their selves with BS, they would say that even if they have done the opposite.
  - Infernal 9y ago
    How did they accomplish this though? Is there a timeout where, after enough FaceID failures cause a fallback to passcode, FaceID is accepted again without entering a passcode in the interim?
- matwood 9y ago
  That's not what I'm saying. They made a face that managed to trick the FaceId, but how many times did they have to test it? In a real world situation, the face would have to work in 3 tries or the phone locks itself with a passcode. Given the elaborate process they went through to make the face, it would be very hard to make a face that basically works the first time (I've noticed FaceId will try multiple times and lock pretty quickly).

sandworm101 9y ago

>> For spies, spooks, government agents etc. I suspect that Face ID would always be a no-no You are correct. Face recognition, like any other biometric, is a bit of a farce. The face doesn't unlock the phone. The face is read by software which then generates some string of numbers, essentially a hash of the face/print, than then unlocks the phone. That hashing process can be hacked/intercepted/replicated just as with any other password. Biometrics is a convenience feature, not security device. But the real reason that biometrics aren't used in highly secure environments it the difficulty of repudiation. If/when a break-in does occur, how exactly does everyone reset their faces? It's like asking everyone to reset their passwords and everyone then using the same passwords. What you have to do is install a new hashing regime and rescan everyone's faces. The best system, the one that is used most everywhere, is three-factor: (1) A card you carry/scan. (2) A password/code you enter into a pad. (3) An old man behind glass, usually a retired soldier, who has been in the job for years and knows everyone in the building. That old man can recognize people better than any biometric scanner.

dhosek 9y ago
Very important note: Be sure to provide the old man behind glass with food and water. I had an old man behind glass in my house for security and didn't think to give him food and water and he died within a week.

amelius 9y ago

> If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance A scanner could be placed e.g. behind or on top of a mirror in a restroom.

sambeau 9y ago
Presumably all you would need is another iPhone X to do the scanning.
- amelius 9y ago
  Yes, but Apple probably has locked down the scanner.
- schrodinger 9y ago
  The data from one iPhone isn’t supposed to be useful to another since the infrared emitters are in a random pattern.
  - coldtea 9y ago
    It doesn't need to be usable to another iPhone for what we're discussing in this subthread. Just to be usable to map the face in 3D space and make a mask.

cvsh 9y ago

>If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance in the outdoors then I think we'd have reason to be worried. I would be astonished if state actors are not already well on their way to figuring out how to do this.

7Z7 9y ago
>For spies, spooks, government agents etc. I suspect that Face ID would always be a no-no as it is much harder to control the ability of others to eavesdrop.
acdha 9y ago
That's true but it's outside the threat model for most devices: that same state-level actor can no doubt use cameras to collect passwords and some combination of imaging and subterfuge to get fingerprints, too.

coldtea 9y ago

>As a consumer this doesn't worry me as to be able to crack my phone it looks like they would already have to have access to my face to make the mask So like what they can gather from 100s of one's photos in social media and other places?

abritinthebay 9y ago
This assumes a lot. As the OP said: demonstrate that from that data you can produce a sufficiently accurate model that works with this method. The article hasn’t. It may be possible (you only have to match the resolution of the IR depth map) but it is not currently demonstrated. Plus I imagine it’s quite easy to refine FaceID in the software as well so an attack like this may not be very long lasting.
- sillysaurus3 9y ago
  Attacks only get better with time. Check back in a couple years and someone may have done just that.
  - abritinthebay 9y ago
    Defenses only get better with time too. That isn’t a good argument. Based on that logic we should have no security ever on anything because it’s always pointless long term.
luxuryballs 9y ago
they also have to gain physical access to your device, so if you're that worried about it, don't use FaceID or do the 'squeeze lock' to disable FaceID and require your passcode for the next unlock before you go to bed or something

Spooky23 9y ago

For a consumer, it's fine -- way better than the bullshit passwords that people use. Once you start getting into higher security areas, you still need multiple identity factors to authenticate people. I'd guess that a bigger potential risk factor for systems like FaceID is intent -- entry of a passcode or fingerprint being placed on a button is a more explicit expression of intent as opposed to glancing at a device.

colordrops 9y ago

So the TSA? https://news.ycombinator.com/item?id=15684139 https://news.ycombinator.com/item?id=15684139

randyrand 9y ago

To make a 3d mask you don't need a 3d scan. You just need a few photographs from different angles and off the shelf photogrammetry software. These scans were made from photographs: http://2.bp.blogspot.com/-c_lP5_5u1Dk/VmM5aDNFHzI/AAAAAAAABzo/H6a24Fdd3Yk/s1600/test1.jpg http://2.bp.blogspot.com/-c_lP5_5u1Dk/VmM5aDNFHzI/AAAAAAAABz...