4 ms·

I love the idea, I had a similar one two years ago (https://github.com/AnandChowdhary/notes/blob/main/notes/2018/2-f-ace-face-unlock.md https://github.com/Anand

I love the idea, I had a similar one two years ago (https://github.com/AnandChowdhary/notes/blob/main/notes/2018/2-f-ace-face-unlock.md https://github.com/AnandChowdhary/notes/blob/main/notes/2018...) to use “face unlock” but as an MFA method. The one problem I had was that face detection using the webcam is not be accurate, e.g., it can be easily fooled using a printed photo of the person or changing the webcam input to use a static photo. With WebAuthn, however, this is not possible because it connects to the device’s native authentication. On macOS, for example, it’s much harder to spoof Touch ID. How would you go about preventing such problems? Isn’t it better to provide an Auth0-style SDK to use WebAuthn with SSO, or do you think using this cloud based image recognition system is as foolproof as the native options?

emilxix 6y ago
That's right, successfully preventing spoofing attacks using 2D input is an extremely hard problem to solve. We've spent two years working on it. We published a high-level overview here - https://getxix.com/learn https://getxix.com/learn and plan to publish a deep-dive overview of the approach in the coming weeks. For SSO, Entry can be added as SAML 2.0 Factor today. I agree if we would not have solved the spoofing problem, taking the Auth0-style route for native platforms is the way to go.
- wgjordan 6y ago
  Relevant quote from the linked overview: > Entry addresses the spoofing issue from 2D input by using an anti-spoofing algorithm that processes a sequence of images obtained from a single camera to build an accurate 3d face reconstruction based on facial key points. Additionally, it estimates the pixel distribution of the input image to detect attacks. Aggregation of both methods achieves high accuracy for detecting attacks on face recognition systems.
  - emilxix 6y ago
    thanks for posting it here. It is still too high-level. We'd be publishing in-depth details soon.
    - Grustaf 6y ago
      This wouldn't seem to help, unless you correlate it with motion sensing data. You can build point clouds from deep fake videos just as easily as from real videos.
- carlosdp 6y ago
  What stops an attacker from spoofing the webcam with a looping video of the subject staring at a camera instead of a still image or holding up a picture?
  - emilxix 6y ago
    Several layers of anti-spoofing. They detect mask-attacks, replay attacks (put the phone with video into the camera; highjack a webcam input and send a pre-recorded video faking to be real-time from zoom for example), and, of course, still images. Give it a try!
    - pmiller2 6y ago
      Wouldn’t you still be vulnerable to attack via a 3D printed or resin cast face (possibly suitably painted)?
      - qbasic_forever 6y ago
        Or just tape a print out to a balloon.
ignoramous 6y ago
> I love the idea, I had a similar one two years ago (https://github.com/AnandChowdhary/notes/blob/main/notes/2018 https://github.com/AnandChowdhary/notes/blob/main/notes/2018...) to use “face unlock” but as an MFA method. btw, https://gazepass.com https://gazepass.com does this as well.

emilxix 6y ago

That's right, successfully preventing spoofing attacks using 2D input is an extremely hard problem to solve. We've spent two years working on it. We published a high-level overview here - https://getxix.com/learn https://getxix.com/learn and plan to publish a deep-dive overview of the approach in the coming weeks. For SSO, Entry can be added as SAML 2.0 Factor today. I agree if we would not have solved the spoofing problem, taking the Auth0-style route for native platforms is the way to go.

wgjordan 6y ago
Relevant quote from the linked overview: > Entry addresses the spoofing issue from 2D input by using an anti-spoofing algorithm that processes a sequence of images obtained from a single camera to build an accurate 3d face reconstruction based on facial key points. Additionally, it estimates the pixel distribution of the input image to detect attacks. Aggregation of both methods achieves high accuracy for detecting attacks on face recognition systems.
- emilxix 6y ago
  thanks for posting it here. It is still too high-level. We'd be publishing in-depth details soon.
  - Grustaf 6y ago
    This wouldn't seem to help, unless you correlate it with motion sensing data. You can build point clouds from deep fake videos just as easily as from real videos.
carlosdp 6y ago
What stops an attacker from spoofing the webcam with a looping video of the subject staring at a camera instead of a still image or holding up a picture?
- emilxix 6y ago
  Several layers of anti-spoofing. They detect mask-attacks, replay attacks (put the phone with video into the camera; highjack a webcam input and send a pre-recorded video faking to be real-time from zoom for example), and, of course, still images. Give it a try!
  - pmiller2 6y ago
    Wouldn’t you still be vulnerable to attack via a 3D printed or resin cast face (possibly suitably painted)?
    - qbasic_forever 6y ago
      Or just tape a print out to a balloon.

ignoramous 6y ago

> I love the idea, I had a similar one two years ago (https://github.com/AnandChowdhary/notes/blob/main/notes/2018 https://github.com/AnandChowdhary/notes/blob/main/notes/2018...) to use “face unlock” but as an MFA method. btw, https://gazepass.com https://gazepass.com does this as well.