4 ms·

> Unfortunately Howdy does not have control over these IR emitters Wasn't sure if "does not" means can't, so I did a search and discovered this interesting dev

• lhl 4y ago
  Ah yeah, that's interesting. I was looking at the actual recognition code in howdy (basically leans on dlib's face detection), which doesn't seem to have any "3D" checker built in, but if it is just based on differential illumination, maybe it won't be so hard to simply make sure there are sufficient differences in the odd/even frames to distinguish a face as 3D. I suppose it could be weak to a "mask" attack, but you could add something like drishti to make sure you can real eyes in addition to a face. Note, even 3D sensors like Apple's FaceID can be broken with sufficient effort: https://www.wired.com/story/hackers-say-broke-face-id-security/ https://www.wired.com/story/hackers-say-broke-face-id-securi... Multi-spectral processing might help in that case, but honestly, if this sort of attack is a real security threat, then you probably shouldn't be running biometric logins in the first place (and you should probably actually be using MFA).
  • als0 4y ago
    Of course, this is all about authentication convenience and keeping the attacker bar high. The mask attack is a lot more expensive/difficult than printing out a photo (too easy).