5 ms·

So - if I followed that correctly the parts you can’t change are the front-camera assembly that includes faceID sensor, and the screen that includes the touch p

So - if I followed that correctly the parts you can’t change are the front-camera assembly that includes faceID sensor, and the screen that includes the touch panel (that you use to enter passwords and PINs). I would assume Apple’s justification is that this is to meet security requirements, particularly given a phone is now commonly used for contactless payments.

uuddlrlr 5y ago
iPhones since the iPhone X have the same repair requirement, however the screen and FaceID are separate so you can continue to use the original. There's nothing special about the touch panels, the FaceID component is a TPM of sorts.
gbraad 5y ago
And the battery as it will report not genuine.
Nextgrid 5y ago
The actual authentication & crypto is happening inside the main SOC. The Face ID sensor is (or should be) just a dumb camera - there's no reason for it to be part of the chain of trust.
- elzbardico 5y ago
  Of course there is. That’s how you avoid replay attacks.
  - Nextgrid 5y ago
    Can't you "replay" that data physically by creating a face mask matching the captured data and then presenting it to a legitimate sensor? IMO the security of the system is that the 3D face data is reasonably secret (you probably can't reconstruct it from a single picture, you'd need pictures from all angles) and the SOC only allows a few attempts before falling back to passcode. If you have the face data, you don't need to tamper with the hardware, and if you don't have that data then tampering with the sensor won't get you anywhere.
    - elzbardico 5y ago
      Exactly because you could have a fake camera that could collect your info and make it accessible for an installed app that would upload it for an hostile server. The original camera doesn’t give you access to this data, a counterfeited one possibly could.
      - danuker 5y ago
        That is absurd. What data is to a face, other than its appearance from various angles? That can be obtained from photos of the person.
  - imajoredinecon 5y ago
    In that case, why not allow a camera replacement with a factory reset?

uuddlrlr 5y ago

iPhones since the iPhone X have the same repair requirement, however the screen and FaceID are separate so you can continue to use the original. There's nothing special about the touch panels, the FaceID component is a TPM of sorts.

gbraad 5y ago

And the battery as it will report not genuine.

Nextgrid 5y ago

The actual authentication & crypto is happening inside the main SOC. The Face ID sensor is (or should be) just a dumb camera - there's no reason for it to be part of the chain of trust.

elzbardico 5y ago
Of course there is. That’s how you avoid replay attacks.
- Nextgrid 5y ago
  Can't you "replay" that data physically by creating a face mask matching the captured data and then presenting it to a legitimate sensor? IMO the security of the system is that the 3D face data is reasonably secret (you probably can't reconstruct it from a single picture, you'd need pictures from all angles) and the SOC only allows a few attempts before falling back to passcode. If you have the face data, you don't need to tamper with the hardware, and if you don't have that data then tampering with the sensor won't get you anywhere.
  - elzbardico 5y ago
    Exactly because you could have a fake camera that could collect your info and make it accessible for an installed app that would upload it for an hostile server. The original camera doesn’t give you access to this data, a counterfeited one possibly could.
    - danuker 5y ago
      That is absurd. What data is to a face, other than its appearance from various angles? That can be obtained from photos of the person.
- imajoredinecon 5y ago
  In that case, why not allow a camera replacement with a factory reset?