10-Year-Old Unlocks Face ID on His Mother's iPhone X as Questionable Mask Spoofing Surfaces

Discussion in 'MacRumors.com News Discussion' started by MacRumors, Nov 14, 2017.

  1. MacRumors macrumors bot


    Apr 12, 2001

    A new video has surfaced of a 10-year-old child unlocking his mother's iPhone X with his face even though Face ID was set up with her face.

    The parents, Attaullah Malik and Sana Sherwani, said their fifth-grade son Ammar Malik simply picked up his mother's new iPhone X without permission and, to their surprise, unlocked the device with his very first glance.
    The younger Malik was then consistently able to unlock his mother's iPhone X, according to his parents. He was even able to unlock his father's iPhone X, but only on one attempt, which he has since been unable to replicate.


    WIRED reporter Andy Greenberg suggested that Sherwani re-register her face to see what would happen. Upon doing so, the iPhone X no longer allowed Ammar access. Interestingly, after Sherwani tried registering her face again a few hours later in the same indoor, nighttime lighting conditions in which she first set up her iPhone X, the son was able to regain access with his face.

    The parents clarified that no one ever entered the iPhone X's passcode after any of the failed unlocking attempts. That's important, since when Face ID fails to recognize you beyond a certain threshold, and you immediately enter a passcode, the TrueDepth camera takes another capture to improve its reliability.

    Apple explains in its Face ID security paper:
    Given no passcode was ever entered, we can assume that Face ID never learned and adjusted for the son's face.

    The same Face ID security paper states that the probability of a false match is higher among children under the age of 13, because their distinct facial features may not have fully developed. Given the child is only 10 years old, and Apple's information, what's shown in the video isn't a surprising flaw.

    Nevertheless, the video is further evidence that Face ID isn't 100 percent foolproof given just the right circumstances. If you are concerned about this, Apple merely recommends using only a passcode to authenticate.

    In related news, Vietnamese security firm Bkav recently shared a video in which it was able to spoof Face ID with a mask. The video is generating headlines since Apple said Face ID uses sophisticated anti-spoofing neural networks to minimize its chances of being spoofed, including with a mask.

    The mask was supposedly crafted by combining 3D printing with makeup and 2D images, with some special processing done on the cheeks and around the face. Bkav said the supplies to make it cost roughly $150.

    We're skeptical about the video given the lack of accompanying details. For instance, Bkav hasn't specified whether it disabled Face ID's default "Require Attention" feature, which provides an additional layer of security by verifying that you are looking at the iPhone before authentication is granted.

    Even if the video is legitimate, it's hardly something that the average person should be concerned about. The chances of someone creating such a sophisticated mask of your facial features would seem extremely slim.

    Apple so far has not responded to the videos, beyond pointing reporters to its existing Face ID security paper we linked to above.

    Article Link: 10-Year-Old Unlocks Face ID on His Mother's iPhone X as Questionable Mask Spoofing Surfaces
  2. miniyou64 macrumors 6502


    Jul 8, 2008
    Regardless if true or not, in practical real world usuage, Face ID is not more secure than Touch ID. Facts.
  3. 840quadra Moderator


    Staff Member

    Feb 1, 2005
    Twin Cities Minnesota
    Do we know how the phone was trained, and how much time it was used before it given to her son? If the password was ever entered just before the device saw his face for the first time?

    Like the mask, it lacks full context.
  4. mi7chy macrumors 601


    Oct 24, 2014
    Apple and apologists could positive spin it as a 'family emergency access' feature. ;)
  5. OldSchoolMacGuy macrumors 601


    Jul 10, 2008
    If you fear for your security, FaceID AND TouchID are poor choices. Go with a very long, secure password. Quit crying.
  6. NCKLS macrumors newbie

    Jun 14, 2017
    Facts? How bout some sources?
    Of course people can trick Face ID into failing by training it to work on similar faces of two separate people. How is that real world practical usage?
  7. dude-x macrumors regular

    Mar 2, 2007
    New York City
    According to the article in Wired, when the mother rescanned her face in better lighting, her son was not able to unlock the phone. Anyway, this is first gen tech. Imagine the 2nd or 3rd gen of FaceID!
  8. Zaft macrumors 68040


    Jun 16, 2009
    Brooklyn, NY
    Anything for clicks.
  9. OldSchoolMacGuy macrumors 601


    Jul 10, 2008
    It sounds like it was right after setting it up for the first time. The system wouldn't have much in the way of information on the correct face so it would be far easier to trick with the face of your child who will have many of the same features as the parent.
  10. stevenisHAUNTED macrumors regular

    Aug 29, 2007
  11. Yourbigpalal83 macrumors member

    May 22, 2015
    Very suspect. for all we know he could have trained the Face ID with the mask to begin with!
  12. RightMACatU macrumors 65816


    Jul 12, 2012
  13. JamieLannister macrumors regular


    Jun 10, 2016

    Jokes aside what do you expect when you pay $1k+ for a smartphone? It should work just give it time. Maybe 7 days until the glue dries. I'll wait for revision #2 or #3.
  14. macTW Suspended

    Oct 17, 2016
    The entire situation smells fishy. Add this quote in and it proves it’s fake. If he gets in once, it learns his face better. Not rejects it later.
  15. JamieLannister macrumors regular


    Jun 10, 2016
    makes absolute sense. Typing in my 16 digit alphanumeric symbolized password while trying to checkout with apple pay at a register. Make as much as sense as paying $1k+ for a phone.
  16. sunapple macrumors 65816


    Jul 16, 2013
    The Netherlands
  17. Avieshek, Nov 14, 2017
    Last edited: Nov 14, 2017

    Avieshek Suspended


    Dec 7, 2013
    Maybe, there was too much pressure from the government but there was also their (Apple's) reputation.
    Face ID works as a middle ground. As much as, permanently scrap Touch ID and call it a progress. Secure hardware & software wise while also allowable to crack.
  18. macTW Suspended

    Oct 17, 2016
    Uhm... the facts we have suggest Face ID is much more secure than Touch ID.

    Sorry the facts get in the way of your biased opinion.
  19. now i see it macrumors 68020

    Jan 2, 2002
    Face ID is much more secure than Touch ID*

    *except when it isn't
  20. macTW Suspended

    Oct 17, 2016
    You can’t have everything. Sorry.

    There are opportinuty costs in life. Want convenience with some security? Use Face ID. Want total security? Use a long alphanumeric password. Want pure, unadulterated security? Get off the grid.
  21. madKIR macrumors 6502a

    Feb 2, 2010
    I can't believe that mask video is still making the rounds! They don't even show how they set up Face ID in the first place. Most likely they set it up by using that mask and turning off Require Attention feature.
  22. bartolo5 macrumors member

    May 11, 2008
    Maybe first pass was trained with mother and second pass was trained with son? That could trip Face ID up
  23. verniesgarden macrumors 65816


    May 29, 2007
    Portland, Or
    Non of them are anymore secure than a passcode since you can still unlock with one.
  24. rishic89 macrumors member


    Nov 9, 2017
    True depth system not changing in 2018.

Share This Page