FaceID Security [pdf]

Questions:

* Does one explicitly set up their FaceID with the option to skip, like how TouchID works currently? I see (when...enabled) verbiage, which is a good sign.

* "The probability that a random person in the population could look at your iPhone X and unlock it using Face ID is approximately 1 in 1,000,000 (versus 1 in 50,000 for Touch ID)" If you have a face that causes most people you meet to say "oh, you look like X, Y, or Z", is this probability reduced? Other comments noted Twins. This isn't meant to be humorous or tongue-and-cheek, there could be a precedent that people of certain appearances are easily spoofed.

* "To avoid a user having to reenroll to Face ID when these neural network changes are made, iPhone X will be able to automatically run stored enrollment images through the updated neural network."

I guess a layperson would see the words "automatically" and relax, but this leaves more to be desired in explaining the "Secure Enclave" to me. The Name "Secure Enclave" almost sounded like remote storage until I read that the data never leaves the device.

Thanks for the downvotes for questions!

[0] http://www.pnas.org/content/102/35/12629.full

> If you refrain from looking at your phone?

Unfortunately, (myself included), we are so conditioned to look at your phone when it is out in our face that you would have to actively train against this "reflex".

I still wish it had an "unlock under duress" mode, where you could authenticate with a subtle difference (different gaze, alternate passcode, etc). The phone would unlock itself but then signal back to the mothership, cloud services and even apps that it's in "duress mode". Display in that mode should look totally normal, just some of the information missing (e.g. emails/messages/contacts from certain groups of contacts flagged as "withhold from duress mode"). This could help mitigate physical danger while preseving some of our critical information.

It's akin to having multiple wallets when visiting high-theft areas. Get held up by an armed thief and give them the cash in the visible wallet, while holding back what's hidden in another location.

> However you can disable TouchID and FaceID both by pressing the power button five times in quick succession

This seems effective "on paper, but not in practice." Even if you're innocent, it is one of the most nerve-racking experiences to go through.

In the heat of the moment, what if you used an old 5s method to deactivate TouchID instead of whatever method works for the X?

I agree with you, but features like this are often the difference have some (decent) security and none at all.

Consider the iPhone prior to TouchID. A lot of people used trivial passcodes, or no passcodes at all.