iPhone X Face ID got fooled by brothers who ARE NOT TWINS

[DrMacintosh]

2 minutes ago, Sniperfox47 said:

there's a very good possibility we could devise a universal method for poisoning the biometrics on an iPhone X and render them moot.

I'll believe it when I see it. 

[Drak3]

Entirety of what I got from this:

 

Facial recognition is always going to be a poor form of security. There are only two solutions: Nigh static or completely static samples, requiring constant database updating to remain functional, or "machine learning" that updates the the database automatically based on "close enough" matches that can be fooled without an extreme amount of effort by people that happen to look quite a bit like you. The latter being less uncommon than people realize.

[ARikozuM]

1 minute ago, Drak3 said:

Entirety of what I got from this:

 

Facial recognition is always going to be a poor form of security. 

Still better than the iris scanner that is fooled by photos. 

 

Also, your new icon sucks. 

[DrMacintosh]

Just now, Drak3 said:

"machine learning"

Why the air quotes? Machine learning is a thing that all your favorite tech companies use.

[Sniperfox47]

1 minute ago, DrMacintosh said:

I'll believe it when I see it. 

That's a problematic attitude with security issues though... With security you should *always* question it, since once you've seen it it's too late.

 

Worse yet, this is a *hardware* issue, meaning you can't just push a software update and say "-fixed".

 

Pushing out this kind of nubile security tech with such little 3rd party vetting, and then presenting it to be as secure as they did is *massively* irresponsible.

[79wjd]

9 minutes ago, Ryan_Vickers said:

possibly confusing it, or trying to mess with it - and so that 1M : 1 number must be for once it's fully developed,

 

which leads me to wonder what it starts out at.

I want to assume that unless it matches you (and thus unlocks) it doesn't add any new information to the profile. So, I don't think confusing it would be an issue -- unless of course you find someone who looks close enough to you and they get accepted. 

 

Good question. But, I also don't see a better way of handling it, other than maybe having an option to force a password for the first few weeks -- so it "unlocks" with your face but requires a password until it's learned enough to reach security maturity^TM. 

[DrMacintosh]

1 minute ago, Drak3 said:

Facial recognition is always going to be a poor form of security.

HA

[DrMacintosh]

Just now, Sniperfox47 said:

Worse yet, this is a *hardware* issue,

You have 0 way of knowing that. 

[Sniperfox47]

Just now, DrMacintosh said:

You have 0 way of knowing that. 

Umm... Except you said yourself earlier that this is a hardware issue, in that they managed to poison enough of the IR projected dots, meaning they are *substantially* lower spacial resolution than Intel Realsense.

[Red Hardware]

4 minutes ago, DrMacintosh said:

Making your user set up your new tech for 10min is not a good image. 

 

People can buy an iPhone and be in it in under 5 min. Making that process possibly 15min or even longer is a solid no from Apple leadership. 

We don't say it should take 15 min

if it takes 5 sec to set it up , make it 10 or 15 (if it even has an effect) and i think the machine learning doesn't have to do much with security but more with growing a beard ...

The problem is that someone who look somehow similar can wear glasses to reduce the accuracy and open the phone . But you don't want to accept that because you are an apple fan

 

[DrMacintosh]

Just now, Sniperfox47 said:

Except you said yourself earlier that this is a hardware issue,

Where?

[Drak3]

Just now, ARikozuM said:

Still better than the iris scanner that is fooled by photos. 

"Iris" scanners like that on the S8? Fuck all that bullshit. Strong PIN and Passwords for those that want security, and let's all just say fuck off with marketing ploys.

[Sniperfox47]

Just now, DrMacintosh said:

Where?

 

1 hour ago, DrMacintosh said:

So two brothers who have a similar facial structure were not able to fool FaceID, only AFTER one of the brothers put on glasses were they able to fool it........

 

If its not obvious to the thread by now, the glasses eliminated enough projected dots to match that the phone allowed him to unlock it because his brother looks like him......

 

People can look identical without being twins....(And Apple said this already)

 

Also if it your sibling is that big of an issue use a damn passcode. 

 

 

Move along, move along. 

 

[DrMacintosh]

Just now, Sniperfox47 said:

 

 

You do know that software is what is analyzing the dot projection right? 

 

 

[79wjd]

1 minute ago, Red Hardware said:

We don't say it should take 15 min

if it takes 5 sec to set it up , make it 10 or 15 (if it even has an effect) and i think the machine learning doesn't have to do much with security but more with growing a beard ...

The problem is that someone who look somehow similar can wear glasses to reduce the accuracy and open the phone . But you don't want to accept that because you are an apple fan

 

Machine learning should also improve security since it doesn't really know what you should look like with glasses, so it has to approximate, but as time goes on, it will have more samples to work with and a wider variety of environments (different hair, glasses, makeup, lightning, etc...). So at least in theory, machine learning should also make it more secure. To what extent is still a complete guess. 

[vanished]

10 minutes ago, djdwosk97 said:

I want to assume that unless it matches you (and thus unlocks) it doesn't add any new information to the profile. So, I don't think confusing it would be an issue

Yeah that would make sense

Quote

-- unless of course you find someone who looks close enough to you and they get accepted. 

Well considering it was fooled by a brother, I think that's a valid concern, especially in the early stage when it's doing more learning than verifying

Quote

Good question. But, I also don't see a better way of handling it, other than maybe having an option to force a password for the first few weeks -- so it "unlocks" with your face but requires a password until it's learned enough to reach security maturity^TM. 

5 minutes ago, djdwosk97 said:

Machine learning should also improve security since it doesn't really know what you should look like with glasses, so it has to approximate, but as time goes on, it will have more samples to work with and a wider variety of environments (different hair, glasses, makeup, lightning, etc...). So at least in theory, machine learning should also make it more secure. To what extent is still a complete guess. 

I still think you could reasonably train it with a little more time spent.  Walk around the house and outside with different lights, put on glasses, take them off, etc.  You could go through a lot of variations in 2 minutes.

 

21 minutes ago, DrMacintosh said:

No, that implies that after 5min there is no more learning that can be done. 

No, not at all.  I like the learning idea, and mentioned it at least a few times, and no where did I suggest it should "lock in" and stop learning at any point.  I just think it should request that you train it as much as reasonably possible before it becomes the primary method of entry.

[Sniperfox47]

2 minutes ago, DrMacintosh said:

You do know that software is what is analyzing the dot projection right? 

 

 

Yes, a neural network is doing facial recognition on the projection, rather than using structural mathematics on the depthmap like Realsense does.

 

That's because with the spacial resolution of the projector, structural mathematics isn't a viable option.

 

But the issue is that a neural network is, by it's very definition, not a mathematically secure method of identification.

[DrMacintosh]

3 minutes ago, Sniperfox47 said:

That's because with the spacial resolution of the projector,

I don't know how much resolution you need for structural mathematics but 30,000 dots is more than enough for Apples needs. 

 

Also why does anyone care about Intel Realsense? They aren't a competitor, nor or they using their tech in any smartphone. 

[Red Hardware]

Just now, djdwosk97 said:

Machine learning should also improve security since it doesn't really know what you should look like with glasses, so it has to approximate, but as time goes on, it will have more samples to work with and a wider variety of environments (different hair, glasses, makeup, lightning, etc...). So at least in theory, machine learning should also make it more secure. To what extent is still a complete guess. 

Yes you are right . It should make it more secure over time . But i don't know if they are doing that now or they are keeping it for the next iphone or the next software update .

There is one thing about machine learning on a phone , face id data stays on the phone as apple said and the storage and the processing power is limited on a phone. We shouldn't expect it to be really smart as it's not using cloud computing. But it should get a little bit better if apple has the right software for it

[vanished]

Just now, DrMacintosh said:

I don't know how much resolution you need for structural mathematics but 30,000 dots is more than enough.

"I don't know how much you need, but this is how many you need"

[DrMacintosh]

Just now, Ryan_Vickers said:

"I don't know how much you need, but this is how many you need"

edited

[vanished]

Just now, DrMacintosh said:

edited

Well it may be enough for what they wanted to achieve but by the sounds of it it's a mathematically different model is all, and with that comes some implications.

[DrMacintosh]

1 minute ago, Red Hardware said:

We shouldn't expect it to be really smart as it's not using cloud computing.

If they did that you would complain how its not secure. So when they make it local you still complain that its not secure......

 

 

[Sniperfox47]

Just now, DrMacintosh said:

I don't know how much resolution you need for structural mathematics but 30,000 dots is more than enough. 

 

Also why does anyone care about Intel Realsense? They aren't a competitor, nor or they using their tech in any smartphone. 

*Facepalm* how are they not a competitor? They're the facial recognition for Windows Hello, which for the record isn't even fooled by twins, much less siblings...

 

And no 30000 dots really isn't... That's about 170x170 resolution, which if you have more than a very modest field of view is going to have next to no spacial resolution (resolution at "x" distance).

 

The resolution it has of your face is a function of the resolution of the projector, the angle of the projection, and the distance your face is.

[Red Hardware]

2 minutes ago, DrMacintosh said:

If they did that you would complain how its not secure. So when they make it local you still complain that its not secure......

 

 

I don't say that they should've made it cloud based . It's better to store that info in the device. I'm just saying that a phone doesn't have that much storage and power to work with