Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID beaten by mask

bkav.com

Post reply on HN
Print view View original

221–230 of 244 posts

Re: Face ID beaten by mask

#221

Post by CodeWriter23 »

mikeash wrote: post #94

I wish they’d tone it down a little. This is really interesting, but stuff like this makes it hard to take them seriously: “Apple has done this not so well. I remember reading an article on Mashable, in which Apple told that iPhone X had been planned to be rolled out in 2018, but the company then decided to release it one year earlier. This shows that they haven't carried out scientific and serious estimation before…

> For one thing, my phone is covered in my own fingerprints, so getting something to copy is a lot easier.

Use your pinky or ring finger for fingerprint recognition.

Re: Face ID beaten by mask

#222

Post by mikeash »

hungerstrike wrote: post #218
mikeash wrote: post #208

Earlier quoted context omitted.

In what way is that "obvious"?

Every single review that I've read has mentioned that it does not work 100% of the time that the reviewer expected it to. That's the first thing that makes it obvious to me because they chose to champion something that does not work over something that does. Biometric security implementations are all gimmicky. The second thing is their claims and their focus on marketing around security. This was easily beaten in its…

Not working 100% of the time when it ought to is evidence that they do care about security. There's always a tradeoff between false positives and false negatives in these systems. Favoring false positives is better for usability, and favoring false negatives is better for security. The most usable biometric system in the world would be one that's hardcoded to return "success" no matter what.

The second thing means they maybe didn't succeed to the extent they wanted to, but certainly doesn't tell us that security wasn't even a goal.

The third thing is irrelevant to the question at hand.

Re: Face ID beaten by mask

#223

Post by oneweekwonder »

joesb wrote: post #164
GrinningFool wrote: post #153

Earlier quoted context omitted.

_>Because we don't touch 20000 other objects every day from where someone can pick our fingertips from?_ We're less likely to lose one of those objects at the same place and time we leave our phone somewhere. It's comparable to leaving your keys in your car. Sure, someone could find those keys where you lost them and then find your car - but is sure is easier for them when they're both in the same place.

> We're less likely to lose one of those objects at the same place and time we leave our phone somewhere. I think it's very likely that you touch something at the place where you left you phone, assuming that it wasn't dropped while you were moving.

or good old tactics wonderfully illustrated in the xkcd: Security[0] cartoon.

[0]: https://xkcd.com/538/

Re: Face ID beaten by mask

#224

Post by cmsj »

adamlett wrote: post #183
syshum wrote: post #115

Earlier quoted context omitted.

>That such a meaningless slogan. Passwords and biometrics have different pros and cons, but they are the same in that they increase security. It is not a meaningless slogan, if Biometrics give the wider public a FALSE sense of security in that companies like Apple pitch them in unrealistic and inaccurate ways in their marketing that gives the average Joe the false idea that bio metrics are more secure than they reall…

Biometrics give the wider public a FALSE sense of security Oh, please! There is an abundance of evidence to show that the wider public is completely uninterested in security to the degree that a majority will disable security features altogether if they are inconvenient to use in the slightest. People don’t use biometric authentication because they are misled to believe that it’s more secure than other methods of sec…

It's also worth noting that iOS defaults to asking for a 6 digit PIN when you set up a new device. You can switch it to 4/0/alphanumeric, but the default is 6.

Re: Face ID beaten by mask

#225

Post by seandougall »

mikeash wrote: post #94

I wish they’d tone it down a little. This is really interesting, but stuff like this makes it hard to take them seriously: “Apple has done this not so well. I remember reading an article on Mashable, in which Apple told that iPhone X had been planned to be rolled out in 2018, but the company then decided to release it one year earlier. This shows that they haven't carried out scientific and serious estimation before…

I have discovered to my surprise, since shattering my iPhone 6 screen last week, that Touch ID works perfectly well through multiple layers of Saran Wrap. So you could keep your thumb wrapped up if you’re concerned about leaving prints. ;-)

In the meantime, my iPhone X arrives on Thursday, and I’m looking forward to training Face ID. All I got from this article was “these are the lengths you have to go to to defeat it”, which seems pretty darn good for my purposes.

Re: Face ID beaten by mask

#226

Post by mikestew »

hungerstrike wrote: post #218
mikeash wrote: post #208

Earlier quoted context omitted.

In what way is that "obvious"?

Every single review that I've read has mentioned that it does not work 100% of the time that the reviewer expected it to. That's the first thing that makes it obvious to me because they chose to champion something that does not work over something that does. Biometric security implementations are all gimmicky. The second thing is their claims and their focus on marketing around security. This was easily beaten in its…

Every single review that I've read has mentioned that it does not work 100% of the time that the reviewer expected it to.

Neither does TouchID, and you’ll pry that from my cold, dead, fingers, one of which will probably be hovering over the TouchID sensor.

Re: Face ID beaten by mask

#227

Post by seandougall »

joesb wrote: post #164
GrinningFool wrote: post #153

Earlier quoted context omitted.

_>Because we don't touch 20000 other objects every day from where someone can pick our fingertips from?_ We're less likely to lose one of those objects at the same place and time we leave our phone somewhere. It's comparable to leaving your keys in your car. Sure, someone could find those keys where you lost them and then find your car - but is sure is easier for them when they're both in the same place.

> We're less likely to lose one of those objects at the same place and time we leave our phone somewhere. I think it's very likely that you touch something at the place where you left you phone, assuming that it wasn't dropped while you were moving.

But you usually don’t draw a circle around the relevant print and leave a note saying “use this one to unlock my phone” (unlike the Touch ID sensor).

Re: Face ID beaten by mask

#228

Post by dkonofalski »

jkubicek wrote: post #205
scribu wrote: post #191

Earlier quoted context omitted.

From Troy Hunt's article: > given the processing power to actually observe and interpret eye movements in the split second within which you expect this to work, this would be a really neat failsafe. Apple highlights this as "attention awareness" Yes, it would be a great failsafe. However, if the PoC demonstrated by Bkav is legit, it would seem that Face ID doesn't look for eye movement; it just checks if the eyes are…

You can also turn attention awareness off. They didn’t specifically mention whether they turned it off or left it on.

According to tweets from Wired, the attention features were disabled when they initially observed the test. There were also questions that they asked that the Bkav team refused to answer.

Re: Face ID beaten by mask

#229

Post by azinman2 »

Spivak wrote: post #219
azinman2 wrote: post #211

Earlier quoted context omitted.

And they shouldn’t rely on consumer-level security protection.

You say that like they don't all use commodity phones and laptops. The idea that people are buying super secure hardware for CEOs is firmly in the realm of screenplays.

I didn’t say they shouldn’t use an iPhone, I said they shouldn’t use consumer level security features. All leading smartphones have enterprise features that change the security profile — for example to use long alphanumeric passwords instead of a PIN or FaceID.

Re: Face ID beaten by mask

#230

Post by coldtea »

mikeash wrote: post #188
coldtea wrote: post #184

Earlier quoted context omitted.

> It's hard to take seriously because they take a story about Apple getting the phone out a year early as somehow demonstrating that Apple hadn't properly studied how the security of Face ID compares with Touch ID. It's a total non sequitur. Non sequitur? Sounds like a totally rational argument to me, to the point of being a tautology. Rushed a feature to market by one year == they also rushed the testing.

There are a lot of holes in your equation there. Apple never said they rushed the phone. They said they were able to get it out early. These are not the same thing; "rushed" implies that quality suffered, while merely getting it out early could just be due to work going faster than anticipated. Even if the phone as a whole was "rushed," that doesn't mean Face ID was. Maybe it was naturally ready by now. Even if Face…

>It's like if you show up early to a meeting and so I accuse you of speeding. Is that sensible?

No, but it is sensible to consider that if they've estimated 2018 themselves as the initial release date and then put it out in 2017, they didn't "made it naturally" but rather rushed it.

I don't say that's 100% proven or anything.

But it's very sensible to consider -- in other words plausible.

It might be "rushing to conclusions" but it's totally not a "non sequitur", since evidence in support is there, even if you find it lacking.

Post reply on HN