Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FaceID Security [pdf]

images.apple.com

Post reply on HN
Print view View original

41–50 of 314 posts

Re: FaceID Security [pdf]

#41

Post by jimmies »

athenot wrote: post #25

I still wish it had an "unlock under duress" mode, where you could authenticate with a subtle difference (different gaze, alternate passcode, etc). The phone would unlock itself but then signal back to the mothership, cloud services and even apps that it's in "duress mode". Display in that mode should look totally normal, just some of the information missing (e.g. emails/messages/contacts from certain groups of conta…

Well, I understand that I kinda have to trust Apple but given Apple have my decrypted contents, shouldn't flagging something as highly sensitive be considered a bad move?

There are circumstances that Apple are obliged to provide with law enforcement what they have, and can't tell you that they provided it.

Having said that, nothing beats an unsynced phone with a long password. No faceId, no AI recognition, no iris, no fingerprint. Just a good old long password.

Re: FaceID Security [pdf]

#42

Post by tptacek »

I was really unhappy about FaceID last week, but if the attention sensing tech works reliably, I think it's probably better --- including under duress --- than TouchID.

Re: FaceID Security [pdf]

#44

Post by strictnein »

dippydipdips wrote: post #2

"Face ID confirms attention by detecting the direction of your gaze" So to the argument that police can force you to open your iPhone if secured with TouchID, is this perhaps more secure? If you refrain from looking at your phone?

Here's what police do today, and it will defeat this and all types of security:

Follow you until you make a phone call, or do something that requires you to unlock your phone. Then multiple people descend on you and grab you and your phone.

Re: FaceID Security [pdf]

#45

Post by dmitriid »

FilterSweep wrote: post #21

Questions: * Does one explicitly set up their FaceID with the option to skip, like how TouchID works currently? I see (when...enabled) verbiage, which is a good sign. * "The probability that a random person in the population could look at your iPhone X and unlock it using Face ID is approximately 1 in 1,000,000 (versus 1 in 50,000 for Touch ID)" If you have a face that causes most people you meet to say "oh, you look…

Secure Enclave isn't somehthing new to FaceID. It was developed for Touch ID. Some details here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Re: FaceID Security [pdf]

#46

Post by nsxwolf »

jonknee wrote: post #12

> To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. I await some interesting articles featuring IR imaging after the X ships.

How does that counter physical spoofs? If I have the 3D printing technology to pull off a Mission:Impossible quality mask of my target, what good does a random IR projection do?

Re: FaceID Security [pdf]

#47

Post by dmitriid »

dippydipdips wrote: post #2

"Face ID confirms attention by detecting the direction of your gaze" So to the argument that police can force you to open your iPhone if secured with TouchID, is this perhaps more secure? If you refrain from looking at your phone?

FaceID and TouchID are not passwords, so you have to comply and unlock your phone.

Re: FaceID Security [pdf]

#48

Post by Angostura »

eridius wrote: post #17
aeontech wrote: post #14

Earlier quoted context omitted.

No, any kind of biometric auth is vulnerable to the adversary forcing your physical compliance. However you can disable TouchID and FaceID both by pressing the power button five times in quick succession, after which it will require your passcode.

For the iPhone X it's hold both the power button and either volume button for 2 seconds.

Actually, I think that’s the hard reset sequence - replacing the Home Power combo

Re: FaceID Security [pdf]

#50

Post by mikewhy »

SomeHacker44 wrote: post #39
aeontech wrote: post #14

Earlier quoted context omitted.

No, any kind of biometric auth is vulnerable to the adversary forcing your physical compliance. However you can disable TouchID and FaceID both by pressing the power button five times in quick succession, after which it will require your passcode.

This is woefully insufficient for a feature I have been begging for forever... I would prefer it to be a double-tap on the power button, or at the very absolute worse, a triple tap. Two buttons simultaneously five times? Impossible to do under any sort of external pressure/duress.

Not sure where you got two buttons from. It's only the power button.
Post reply on HN