Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID beaten by mask

bkav.com

Post reply on HN
Print view View original

211–220 of 244 posts

Re: Face ID beaten by mask

#211

Post by azinman2 »

nvr219 wrote: post #17
sambeau wrote: post #9

As a consumer this doesn't worry me as to be able to crack my phone it looks like they would already have to have access to my face to make the mask (and an expert sculpture to make a nose). If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance in the outdoors then I think we'd have reason to be worried. For spies, spooks, government agents etc. I suspect that Face ID…

yeah this is mostly like, multinational CEOs, etc who would be targeted

And they shouldn’t rely on consumer-level security protection.

Re: Face ID beaten by mask

#212

Post by valuearb »

fermuch wrote: post #18
baxtr wrote: post #5

> A: We used a popular 3D printer. Nose was made by a handmade artist. We use 2D printing for other parts (similar to how we tricked Face Recognition 9 years ago). The skin was also hand-made to trick Apple's AI. > Q: What's the approximate cost of the mask? > A: ~ 150 USD Taken together, the second answer cannot be true. Only if the cost stated is related to material cost only, which is is only one input factor to a…

What other cost are you referring to? The 3D printer? You can send your design to a studio and they'll print it for you and send it, or you can rent time in some places to get access to a printer, without needing to buy one. In any case, if it needed only a paper print, you wouldn't count the cost of the printer, since you can print it anywhere.

$150 for a printable parts of the mask.

Then "hand made" skin, which they don't reference cost or time spent creating.

Then "hand made" nose, which they don't reference cost or time spent creating.

Also makeup, which they don't reference cost or time spent applying.

This is a security firm serving up info with HTTP, not HTTPS, ducking every serious question to the point it seems likely they are hiding something. Even if everything they claim is true, their attack vector is so difficult chances of success would seem to be effectively nil.

Re: Face ID beaten by mask

#213

Post by valuearb »

x0x0 wrote: post #15
baxtr wrote: post #5

> A: We used a popular 3D printer. Nose was made by a handmade artist. We use 2D printing for other parts (similar to how we tricked Face Recognition 9 years ago). The skin was also hand-made to trick Apple's AI. > Q: What's the approximate cost of the mask? > A: ~ 150 USD Taken together, the second answer cannot be true. Only if the cost stated is related to material cost only, which is is only one input factor to a…

Nitpicking the cost of the labor to build this mask misses the point of the article: face id is much less secure than Apple claims.

They've shown an "attack vector" that's virtually impossible to reproduce. Someone has to be able to get detailed 3D renders of your face before also stealing your phone. Then they have to get a team of artists to hand craft your nose, hand craft human like skin, 3D print a mask, and a makeup artist to make it all look realistic.

In the end, they've shown is FaceID is just as secure as Apple claimed. Apple never claimed impervious to any attacks, they claimed it would work well an quickly, and be more resistant to attack than TouchID. Requiring a Mission Impossible level team to create a mask that duplicates your face is not a level of attack most customers are concerned with.

TouchID can be defeated simply by stealing the device, lifting the owners fingerprints from said device, and 3d printing duplicate prints to use. FaceID is far more secure than that.

Re: Face ID beaten by mask

#214

Post by ravitation »

criddell wrote: post #203
toyg wrote: post #120

Earlier quoted context omitted.

Biometrics are weaker than anything that relies on knowledge, for the simple fact that a physical attack IRL cannot be resisted. One could die without revealing a pin or password, but a biometric device would reveal his secrets very quickly through simple coercion and even after death has occurred.

When you start to think about attacks from adversaries with lots of resources (like governments), are passwords safe from fMRI-assisted interrogations?

Uh... Yes? fMRI isn't telepathy.

Re: Face ID beaten by mask

#215

Post by valuearb »

tormeh wrote: post #58
nobodyshere wrote: post #54

Earlier quoted context omitted.

They realize that at Apple too. Face/Touch ID can be forcefully disabled for enterprise. However for an average Joe this is not a threat.

Can you require both face and password?

That would be an extremely bad idea. In that scenario, imagine FaceID fails to recognize you, now you can't get into your device. Currently if FaceID fails, you have passcode as an alternative way into the device.

Re: Face ID beaten by mask

#216

Post by Geee »

syshum wrote: post #6

Biometrics are usernames not passwords. Biometrics should never be used on the sole authentication method they should only be used in conjunction with something else.

That something else is your device. Biometrics should never be used on remote systems.

Re: Face ID beaten by mask

#217

Post by valuearb »

vultour wrote: post #8

Wonder if this would work have Apple not relaxed their FaceID sensor requirements to ship the phones more quickly.

Apple denies they ever relaxed any sensor requirements.

Attacks will always be possible because FaceID can never be infinitely precise. Your face changes over time, even during the day. People wear glasses or sunglasses sometimes, and take them off sometimes. They grow facial hair, and shave it off. They wear makeup, and take it off. They pick up black eyes in jui-jitsu class.

There is a balance between maximum precision and maximum usability. Apple's task was to find that balance. This hacked up "exploit" does nothing but show they found the proper balance.

Re: Face ID beaten by mask

#218

Post by hungerstrike »

mikeash wrote: post #208
hungerstrike wrote: post #198

Earlier quoted context omitted.

It's hard to take Apple seriously about Face ID when it's now obvious that security wasn't the goal at all. Face ID is a gimmick to keep attention on the iPhone.

In what way is that "obvious"?

Every single review that I've read has mentioned that it does not work 100% of the time that the reviewer expected it to. That's the first thing that makes it obvious to me because they chose to champion something that does not work over something that does. Biometric security implementations are all gimmicky.

The second thing is their claims and their focus on marketing around security. This was easily beaten in its first week in the real world! So it's not really that secure is it?

The third thing is that Apple has a long history of choosing gimmicks over actual functionality. The OS X dock is just one example of this.

Re: Face ID beaten by mask

#219

Post by Spivak »

azinman2 wrote: post #211
nvr219 wrote: post #17

Earlier quoted context omitted.

yeah this is mostly like, multinational CEOs, etc who would be targeted

And they shouldn’t rely on consumer-level security protection.

You say that like they don't all use commodity phones and laptops. The idea that people are buying super secure hardware for CEOs is firmly in the realm of screenplays.

Re: Face ID beaten by mask

#220

Post by randyrand »

sambeau wrote: post #9

As a consumer this doesn't worry me as to be able to crack my phone it looks like they would already have to have access to my face to make the mask (and an expert sculpture to make a nose). If they could demonstrate it working from a 3D printed mask taken from a surreptitious scan at distance in the outdoors then I think we'd have reason to be worried. For spies, spooks, government agents etc. I suspect that Face ID…

To make a 3d mask you don't need a 3d scan. You just need a few photographs from different angles and off the shelf photogrammetry software.

These scans were made from photographs: http://2.bp.blogspot.com/-c_lP5_5u1Dk/VmM5aDNFHzI/AAAAAAAABz...

Post reply on HN