I wonder how these face detection algorithms work for transgender folks...
Unless they're getting extensive facial surgery, their phones will acknowledge them.
Face ID and Touch ID for the Web
231–240 of 274 posts
Re: Face ID and Touch ID for the Web
#232So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
Is this how passwords.google.com prompts me with my Android phone lock when I want to access a password in plaintext? I've always wondered that.
Re: Face ID and Touch ID for the Web
#233FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standar…
Why did fingerprinting never catch on in that way? That tech has existed for ages. Way cheaper to implement as well. Seems like it would also be less prone to false positives compared to facial recognition, but that’s just speculation on my part.
Fingerprints are left everywhere and even photographed from a distance. It is harder to 3D scan a face then recreate it in such a way as to fool Face ID although I am sure it is possible.
Re: Face ID and Touch ID for the Web
#234FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standar…
Why did fingerprinting never catch on in that way? That tech has existed for ages. Way cheaper to implement as well. Seems like it would also be less prone to false positives compared to facial recognition, but that’s just speculation on my part.
Touch ID has been hacked multiple times. It's not reliable.
0] The probability that a random person in the population could look at your iPhone or iPad Pro and unlock it using Face ID is approximately 1 in 1,000,000 with a single enrolled appearance. As an additional protection, Face ID allows only five unsuccessful match attempts before a passcode is required. The statistical probability is different for twins and siblings that look like you and among children under the age of 13, because their distinct facial features may not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate.
For comparison, touch ID has a probability of 1 in 50,000.
Re: Face ID and Touch ID for the Web
#235This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…
I think some unlikely security scenarios are neglected though. You trust you platform to keep your private keys safe and it requires you to trust is. A vulnerability here would compromise your whole identity if private keys can be extracted. I don't yet believe that to be impossible. Will solve common problems like fishing though.
Re: Face ID and Touch ID for the Web
#236FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standar…
I can’t tell if you’re joking.
Re: Face ID and Touch ID for the Web
#237So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
Can someone explain how does it work behind the scenes?
As I see it, data is stored in a secure enclave separate from the processor and OS. It only provides a match value based on the generated digital private key. So phones will create a separate pair for every site and send the public key with credentials so the server can verify it with the device.
Wouldn't apple have to open source their hardware as well?
Re: Face ID and Touch ID for the Web
#238Re: Face ID and Touch ID for the Web
#239Linking biometrics to cryptographic authentication is difficult. When I worked on this problem about 5-6 years ago somewhere else, it came down to adding a separate applet for the biometric verification to the secure element, which then authenticated itself to the user authN applet, which was then authorized to generate the user authentication cryptogram. Biometrics are probabilistic samples of data, where cryptograp…
There are ways to use error-correcting codes to turn probabilistic samples into deterministic ones and mix them with a key. These are constructed so that you gain no information if you only know the key, or only know the biometric. See https://en.wikipedia.org/wiki/Fuzzy_extractor.
Re: Face ID and Touch ID for the Web
#240A fingerprint can be a personal password or it can be a government ID, but it can’t be both. Since the U.S. government already has something like 200 million fingerprints on file, and many foreign governments collect fingerprints whenever you travel, these fingerprints are sometimes leaked en masse ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management... ), and because they can never be changed, biometrics a…
In addition, fingerprints and faces are particularly bad biometrics for keeping secrets, because attackers can get hold of them without you noticing.
E.g. anyone can take a picture of you in a crowd, or lift your fingerprints if they can get to somewhere you've been. But they can't do a surreptitious retinal scan on you.