iPhone X Face ID got fooled by brothers who ARE NOT TWINS

[vanished]

Just now, djdwosk97 said:

I didn't think I saw this mentioned, but FaceID is supposed to "learn" your face....so I wonder if it would still fail after a week, month, etc... of "learning".

Really?  That's interesting.  Shouldn't the learning process be done before you start using it though? I mean, imagine if passwords worked like that... at first getting a few letters right would be enough but after using it many times it would become more secure

[Drak3]

6 minutes ago, done12many2 said:

You know why.

?

2 minutes ago, RadiatingLight said:

I'd argue that nearly everyone cares.

I wouldn't. Only those smart enough to care, should they have a reason to care.

 

1 minute ago, RadiatingLight said:

I don't have a password on my phone to protect from some elite hackers -- I have my password on there mostly to protect from my friends messing with my phone.

I have a password to keep phones with physical home buttons or variations of the 'knock knock' feature from thinking I'm using it in my pockets.

[DrMacintosh]

1 minute ago, RadiatingLight said:

False positive chance that is really damn high with people who you live with? most people will care.

The only issue is that not only do you have to have a sibling, you also have to have one that is the same gender as you, and then one that has to look like you. 

 

If that is the case for you then maybe don't use FaceID. 

[RadiatingLight]

4 minutes ago, strat guy said:

how long before people will have to lick a sensor to unlock their phones ?

 

[DrMacintosh]

1 minute ago, Ryan_Vickers said:

Shouldn't the learning process be done before you start using it though?

No. You set it up, then over time using machine learning, the phone adds more data to the map of your face over time.

[Drak3]

1 minute ago, Ryan_Vickers said:

Shouldn't the learning process be done before you start using it though

No, too logical.

[RadiatingLight]

1 minute ago, Ryan_Vickers said:

Really?  That's interesting.  Shouldn't the learning process be done before you start using it though? I mean, imagine if passwords worked like that... at first getting a few letters right would be enough but after using it many times it would become more secure

IIRC it take a random percentage of successful attempts and learns from them, so if you grow a beard it can update the facial model as you go, instead of you needing to re-do your faceID every week of growth.

[vanished]

3 minutes ago, DrMacintosh said:

No. You set it up, then over time using machine learning, the phone adds more data to the map of your face over time.

I'm gonna have to stick with what I said... however much data it needs should be trained before you start relying on it to secure your phone.  If that means a 5 minute setup process rather than 10 seconds, so be it, at least you know it's good right from the onset.

 

2 minutes ago, RadiatingLight said:

IIRC it take a random percentage of successful attempts and learns from them, so if you grow a beard it can update the facial model as you go, instead of you needing to re-do your faceID every week of growth.

That's good that it can update since people do change over time (children growing, cutting hair, growing beard, getting injured, etc.) but still, it should make sure it has a "complete" dataset before letting you activate it.

[RadiatingLight]

1 minute ago, Ryan_Vickers said:

I'm gonna have to stick with what I said... however much data it needs should be trained before you start relying on it to secure your phone.  If that means a 5 minute setup process rather than 10 seconds, so be it, at least you know it's good right from the onset.

But what if you grow a beard?

5 Minute setup process twice a month as your face changes?

[Red Hardware]

3 minutes ago, gabrielcarvfer said:

"the chance of a random person being able to unlock your phone is 1 in 1,000,000"
What they said might be true, because a sibling is not a random person. but that's not good enough.

yes but there are random persons that look similar and wearing a glasses reduces the usable dots that the phone can use to determine that it's you or not so if the other person wears a glass, he/she won't need to be really similar as siblings 

[done12many2]

9 minutes ago, strat guy said:

how long before people will have to lick a sensor to unlock their phones ?

 

That almost resulted in a mouthful of Coke on my screen.  Let me know that's coming next time.   K?  Thanks.

[vanished]

Just now, RadiatingLight said:

But what if you grow a beard?

5 Minute setup process twice a month as your face changes?

No, it can still learn   There's a middle ground between not learning at all and taking a quick glance and saying "good enough" and then raining that in over time as you (or someone similar) uses it.

[DrMacintosh]

Just now, Ryan_Vickers said:

If that means a 5 minute setup process rather than 10 seconds, so be it

No, that implies that after 5min there is no more learning that can be done. 

 

Apple even said that it does this because your face changes week to week and even day to day. 

 

If you set it up all at once and you forgot to shave one day you might not be able to get into your phone. However if you use machine learning it would see that you are slowly growing out your mustache and would build up the map of your face. 

 

I see the logic in what you said but this is one of those times when logic is overridden by practicality. 

[79wjd]

5 minutes ago, Drak3 said:

No, too logical.

Feel free to sit in front of your phone for a week as you permute through every combination of clothes, lightning, angles, facial hair, weather, etc... to get something that will still always be weaker than a decent fallback password. 

 

3 minutes ago, Ryan_Vickers said:

I'm gonna have to stick with what I said... however much data it needs should be trained before you start relying on it to secure your phone.  If that means a 5 minute setup process rather than 10 seconds, so be it, at least you know it's good right from the onset.

Well, the idea is that it samples your face in different conditions -- when wearing glasses, hats, makeup, hair, different lighting, when your face is flushed/very red, etc... It would be completely unreasonable to do all of that during the setup process. So it gets a good initial estimate and then adapts and in theory should become more secure and accurate over time. 

[Drak3]

1 minute ago, RadiatingLight said:

But what if you grow a beard?

5 Minute setup process twice a month as your face changes?

Password backup...

 

Oh wait, that completely invalidates FaceID as soon as one builds up a good stubble.

[79wjd]

1 minute ago, Drak3 said:

POh wait, that completely invalidates FaceID as soon as one builds up a good stubble.

Hence why it learns and adapts.....and why any pre-configured setup that couldn't would be horrendous. 

[ARikozuM]

24 minutes ago, RadiatingLight said:

However, I can't see him realistically making a mold of my finger, or creeping up on me while sleeping to unlock my phone.

He wouldn't need to touch you at all. It's surprisingly easy to lift prints off a mug, plastic cup, even paper, where all you would need is to place the print and then apply pressure for the scanner to read it. 

 

As far as FaceID, doesn't 1M:1 still mean that there's 7000 people out there that would fool the system? Also, why can't Apple just cancel out the recognition if the user is wearing glasses out of the norm?

[vanished]

Just now, djdwosk97 said:

Well, the idea is that it samples your face in different conditions -- when wearing glasses, hats, makeup, different lighting, when your face is flushed/very red, etc... It would be completely unreasonable to do all of that during the setup process. So it gets a good initial estimate and then adapts and in theory should become more secure and accurate over time. 

The issue I see with that is it's just not going to be able to be as secure during that early phase - the same period when everyone is going to be wanting a look at your new phone and possibly confusing it, or trying to mess with it - and so that 1M : 1 number must be for once it's fully developed, which leads me to wonder what it starts out at.

[DrMacintosh]

Just now, Drak3 said:

Password backup...

 

Oh wait, that completely invalidates FaceID as soon as one builds up a good stubble.

So you would rather have a static face and have to set up FaceID again every 3 days? 

 

Sounds like wasted time to me. Apple has a dedicated machine learning chip for a reason. 

[Red Hardware]

1 minute ago, DrMacintosh said:

No, that implies that after 5min there is no more learning that can be done. 

 

Apple even said that it does this because your face changes week to week and even day to day. 

 

If you set it up all at once and you forgot to shave one day you might not be able to get into your phone. However if you use machine learning it would see that you are slowly growing out your mustache and would build up the map of your face. 

 

I see the logic in what you said but this is one of those times when logic is overridden by practicality. 

we don't say it shouldn't use machine learning , we say that it should be as safe as it can be at the start and then use machine learning to understand that its you after you grow a beard and i think that's what apple doing here

[DrMacintosh]

1 minute ago, ARikozuM said:

why can't Apple just cancel out the recognition if the user is wearing glasses out of the norm?

They could but I guess Sunglasses can be thrown on at any time. Its just hard to tell when its legit or being tricked. 

[DrMacintosh]

2 minutes ago, Red Hardware said:

we say that it should be as safe as it can be at the start

Making your user set up your new tech for 10min is not a good image. 

 

People can buy an iPhone and be in it in under 5 min. Making that process possibly 15min or even longer is a solid no from Apple leadership. 

[Sniperfox47]

I love how some of the people defending faceid in this thread are the same people who said that faceid would be better than Intel Realsense in the announcement thread, or that it's use on a phone wouldn't put power and size constraints on it that limit the quality of security.

 

@DrMacintosh since a ton of theft happens to close family members how is "well it's only a worry with your siblings" an excuse?

 

And besides that, if wearing glasses were enough to poison the data and fool it for these pair of brothers, who knows what kind of technique can be used to poison the data to increase the chances of a false positive moving forward. Especially if you set up the phone against an adversarial neural net, there's a very good possibility we could devise a universal method for poisoning the biometrics on an iPhone X and render them moot.

 

There's a very good possibility that once people start trying to fool faceid it'll be far easier to spoof than a fingerprint. That Hollywood mask makers couldn't fool it says absolutely nothing because they're not security specialists...

[ARikozuM]

1 minute ago, DrMacintosh said:

They could but I guess Sunglasses can be thrown on at any time. Its just hard to tell when its legit or being tricked. 

I would make it so that it won't function, or ask for a password, whenever it detects too many missing projections or asking to remove any glasses. 

[DrMacintosh]

2 minutes ago, ARikozuM said:

I would make it so that it won't function, or ask for a password,

"Hey, we noticed you are wearing some glasses. Enter your passcode so we know its you" 

 

It could then add those glasses to your facial map. 

 

I would be ok with that.