Live data from Hacker News

Face ID beaten by mask

bkav.com

41–50 of 244 posts

Re: Face ID beaten by mask

#41
post #20

It's conspicuous that the real face of the user of the iPhone isn't shown in the video or in photos on the site.

In the video, he shows the iPhone being unlocked with his own face at 1:06: https://m.youtube.com/watch?v=i4YQRLQVixM

So it does. It seems that the iPhone is better at recognising faces than me at least.

Re: Face ID beaten by mask

#42
post #9

As a consumer this doesn't worry me as to be able to crack my phone it looks like they would already have to have access to my face to make the mask (and an expert sculpture to make a nose). If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance in the outdoors then I think we'd have reason to be worried. For spies, spooks, government agents etc. I suspect that Face ID…

Two words: incremental improvement. 3d printing is getting better and cheaper all the time. Cameras and software are getting better all the time. If someone cares enough to invest the R&D it should be pretty easy to automate everything between getting photos someone and printing the mask. The point is that using biometric authentication as an all-in-one isn't secure.

Photos are not enough, they would need a high resolution 3D scan on the person’s face as well. Also they didn’t just use 3D printing, they had to use different fabrication methods and materials for different parts of the face part of which was ‘simply’ hand sculpted. This is not at all trivial to automate.

But then we already know it’s not as secure as two factor authentication and a random passcode. Touch ID could be fooled with predict fingerprints as well, though with the deep subcutaneous scanning in later versions it was much harder than with the first version. Anyway, Nobody who critically depends on the security of their phone should use Face ID or Touch ID anyway.

Re: Face ID beaten by mask

#43

I re-read the whole thing but cannot find what special processing is all about. Is it molding using clay or something?

The special processing is done to large areas of skin, so I would say that it is makeup powder to make the plastic have IR reflective properties of real skin.

Re: Face ID beaten by mask

#44
post #13

So, fingerprints are not "secure", face recognition is not "secure"... Are passwords/double authentication the only way to keep things private and secure these days? Are there any serious alternative?

I've read somewhere (probably in one of Troy Hunt's posts) that biometric data should not the be password, but rather the username. Maybe we're looking at this the wrong way. Biometric data seams to be equivalent (or at least similar) to a public key.

Re: Face ID beaten by mask

#45
post #21
post #4

The 1st point is, everything went much more easily than you expect. You can try it out with your own iPhone X, the phone shall recognize you even when you cover a half of your face. It means the recognition mechanism is not as strict as you think, Apple seems to rely too much on Face ID's AI. We just need a half face to create the mask. It was even simpler than we ourselves had thought. Interesting. I expected this t…

> We used a popular 3D printer. Nose was made by a handmade artist. We use 2D printing for other parts (similar to how we tricked Face Recognition 9 years ago). The skin was also hand-made to trick Apple's AI. That seems reasonably obscure (:

This is the first step, it's only going to get easier from now on.

Re: Face ID beaten by mask

#48
post #18
post #5

> A: We used a popular 3D printer. Nose was made by a handmade artist. We use 2D printing for other parts (similar to how we tricked Face Recognition 9 years ago). The skin was also hand-made to trick Apple's AI. > Q: What's the approximate cost of the mask? > A: ~ 150 USD Taken together, the second answer cannot be true. Only if the cost stated is related to material cost only, which is is only one input factor to a…

What other cost are you referring to? The 3D printer? You can send your design to a studio and they'll print it for you and send it, or you can rent time in some places to get access to a printer, without needing to buy one. In any case, if it needed only a paper print, you wouldn't count the cost of the printer, since you can print it anywhere.

Human labor cost for example, but apart from that: how many masks were used to trick Face ID? I would assume it was not prototype number 1 that did the trick

Re: Face ID beaten by mask

#49
post #13

So, fingerprints are not "secure", face recognition is not "secure"... Are passwords/double authentication the only way to keep things private and secure these days? Are there any serious alternative?

Nothing is secure about a determined attacker (in the same way the door to your house doesn't resist being battered with a ram)

The issue is convenience together with good enough security

Post reply on HN