4 ms·

Tell me again how FaceID will be "so much more secure" than TouchID - when Apple itself is sharing those 3D facial profiles with third-party vendors (and govern

by mtgx 9y ago

Tell me again how FaceID will be "so much more secure" than TouchID - when Apple itself is sharing those 3D facial profiles with third-party vendors (and governments). In practice, fingerprint readers should still remain significantly more secure than any facial recognition technology.

djrogers 9y ago
Apps get a coarse depth map - this cannot be used to replicate your face in perfect 3D, nor can it be used to bypass FaceID.
- wuliwong 9y ago
  I'm not a security expert but this seems like are giving out a coarse approximation of my username (that has no password protection). I would think it is significantly easier to break into FaceID starting with the coarse depth map than no depth map at all. But again, I could just be out of my depth on this topic and the difference isn't that big of a deal?
  - yeldarb 9y ago
    It's possible but I 3D printed the face mesh from their API and it didn't work to unlock Face ID on my phone. It did a pretty good job of scanning my face though: https://twitter.com/braddwyer/status/930594896523567104 https://twitter.com/braddwyer/status/930594896523567104
wuliwong 9y ago
I admit that I am pretty ignorant to the really technical aspects of security but it seems that using authentication data for anything other than authentication is poor practice. I can understand the desire to use facial stuff to make interesting technology but I would prefer knowing that it is only used for the purpose of unlocking my device and nothing else. It seems fingerprints are less interesting for other apps so there wasn't the same motivation to share it. Am I being an alarmist or is it reasonable to be concerned about this?
- jakelazaroff 9y ago
  There's a missing link between "third-party apps have access to the depth sensor data" and "depth sensor data is used to identify your face for FaceID". The iOS biometric authentication API is basically just a call for the OS to check your information and return whether or not it succeeded [1]. Third parties can't just take the biometric data and use it to bypass your authentication without having physical access to your phone. [1] https://developer.apple.com/documentation/localauthentication https://developer.apple.com/documentation/localauthenticatio...

by mtgx 9y ago

djrogers 9y ago

Apps get a coarse depth map - this cannot be used to replicate your face in perfect 3D, nor can it be used to bypass FaceID.

wuliwong 9y ago
I'm not a security expert but this seems like are giving out a coarse approximation of my username (that has no password protection). I would think it is significantly easier to break into FaceID starting with the coarse depth map than no depth map at all. But again, I could just be out of my depth on this topic and the difference isn't that big of a deal?
- yeldarb 9y ago
  It's possible but I 3D printed the face mesh from their API and it didn't work to unlock Face ID on my phone. It did a pretty good job of scanning my face though: https://twitter.com/braddwyer/status/930594896523567104 https://twitter.com/braddwyer/status/930594896523567104

wuliwong 9y ago

I admit that I am pretty ignorant to the really technical aspects of security but it seems that using authentication data for anything other than authentication is poor practice. I can understand the desire to use facial stuff to make interesting technology but I would prefer knowing that it is only used for the purpose of unlocking my device and nothing else. It seems fingerprints are less interesting for other apps so there wasn't the same motivation to share it. Am I being an alarmist or is it reasonable to be concerned about this?

jakelazaroff 9y ago
There's a missing link between "third-party apps have access to the depth sensor data" and "depth sensor data is used to identify your face for FaceID". The iOS biometric authentication API is basically just a call for the OS to check your information and return whether or not it succeeded [1]. Third parties can't just take the biometric data and use it to bypass your authentication without having physical access to your phone. [1] https://developer.apple.com/documentation/localauthentication https://developer.apple.com/documentation/localauthenticatio...