10-Year-Old Unlocks Face ID on His Mother's iPhone X as Questionable Mask Spoofing Surfaces

Discussion in 'MacRumors.com News Discussion' started by MacRumors, Nov 14, 2017.

  1. MacRumors macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    A new video has surfaced of a 10-year-old child unlocking his mother's iPhone X with his face even though Face ID was set up with her face.


    The parents, Attaullah Malik and Sana Sherwani, said their fifth-grade son Ammar Malik simply picked up his mother's new iPhone X without permission and, to their surprise, unlocked the device with his very first glance.
    The younger Malik was then consistently able to unlock his mother's iPhone X, according to his parents. He was even able to unlock his father's iPhone X, but only on one attempt, which he has since been unable to replicate.

    [​IMG]

    WIRED reporter Andy Greenberg suggested that Sherwani re-register her face to see what would happen. Upon doing so, the iPhone X no longer allowed Ammar access. Interestingly, after Sherwani tried registering her face again a few hours later in the same indoor, nighttime lighting conditions in which she first set up her iPhone X, the son was able to regain access with his face.

    The parents clarified that no one ever entered the iPhone X's passcode after any of the failed unlocking attempts. That's important, since when Face ID fails to recognize you beyond a certain threshold, and you immediately enter a passcode, the TrueDepth camera takes another capture to improve its reliability.

    Apple explains in its Face ID security paper:
    Given no passcode was ever entered, we can assume that Face ID never learned and adjusted for the son's face.

    The same Face ID security paper states that the probability of a false match is higher among children under the age of 13, because their distinct facial features may not have fully developed. Given the child is only 10 years old, and Apple's information, what's shown in the video isn't a surprising flaw.

    Nevertheless, the video is further evidence that Face ID isn't 100 percent foolproof given just the right circumstances. If you are concerned about this, Apple merely recommends using only a passcode to authenticate.

    In related news, Vietnamese security firm Bkav recently shared a video in which it was able to spoof Face ID with a mask. The video is generating headlines since Apple said Face ID uses sophisticated anti-spoofing neural networks to minimize its chances of being spoofed, including with a mask.


    The mask was supposedly crafted by combining 3D printing with makeup and 2D images, with some special processing done on the cheeks and around the face. Bkav said the supplies to make it cost roughly $150.

    We're skeptical about the video given the lack of accompanying details. For instance, Bkav hasn't specified whether it disabled Face ID's default "Require Attention" feature, which provides an additional layer of security by verifying that you are looking at the iPhone before authentication is granted.

    Even if the video is legitimate, it's hardly something that the average person should be concerned about. The chances of someone creating such a sophisticated mask of your facial features would seem extremely slim.

    Apple so far has not responded to the videos, beyond pointing reporters to its existing Face ID security paper we linked to above.

    Article Link: 10-Year-Old Unlocks Face ID on His Mother's iPhone X as Questionable Mask Spoofing Surfaces
     
  2. miniyou64 macrumors 6502

    miniyou64

    Joined:
    Jul 8, 2008
    #3
    Regardless if true or not, in practical real world usuage, Face ID is not more secure than Touch ID. Facts.
     
  3. 840quadra Moderator

    840quadra

    Staff Member

    Joined:
    Feb 1, 2005
    Location:
    Twin Cities Minnesota
    #4
    Do we know how the phone was trained, and how much time it was used before it given to her son? If the password was ever entered just before the device saw his face for the first time?

    Like the mask, it lacks full context.
     
  4. mi7chy macrumors 68040

    mi7chy

    Joined:
    Oct 24, 2014
    #5
    Apple and apologists could positive spin it as a 'family emergency access' feature. ;)
     
  5. OldSchoolMacGuy macrumors 68030

    OldSchoolMacGuy

    Joined:
    Jul 10, 2008
    #6
    If you fear for your security, FaceID AND TouchID are poor choices. Go with a very long, secure password. Quit crying.
     
  6. NCKLS macrumors newbie

    Joined:
    Jun 14, 2017
    #7
    Facts? How bout some sources?
    Of course people can trick Face ID into failing by training it to work on similar faces of two separate people. How is that real world practical usage?
     
  7. dude-x macrumors regular

    Joined:
    Mar 2, 2007
    Location:
    New York City
    #8
    According to the article in Wired, when the mother rescanned her face in better lighting, her son was not able to unlock the phone. Anyway, this is first gen tech. Imagine the 2nd or 3rd gen of FaceID!
     
  8. Zaft macrumors 68040

    Zaft

    Joined:
    Jun 16, 2009
    Location:
    Brooklyn, NY
    #9
    Anything for clicks.
     
  9. OldSchoolMacGuy macrumors 68030

    OldSchoolMacGuy

    Joined:
    Jul 10, 2008
    #10
    It sounds like it was right after setting it up for the first time. The system wouldn't have much in the way of information on the correct face so it would be far easier to trick with the face of your child who will have many of the same features as the parent.
     
  10. stevenisHAUNTED macrumors regular

    Joined:
    Aug 29, 2007
    Location:
    Texas
  11. Yourbigpalal83 macrumors member

    Joined:
    May 22, 2015
    #12
    Very suspect. for all we know he could have trained the Face ID with the mask to begin with!
     
  12. RightMACatU macrumors 65816

    RightMACatU

    Joined:
    Jul 12, 2012
    Location:
    192.168.1.1
  13. JamieLannister macrumors regular

    JamieLannister

    Joined:
    Jun 10, 2016
    #14
    Face-gate.

    Jokes aside what do you expect when you pay $1k+ for a smartphone? It should work just give it time. Maybe 7 days until the glue dries. I'll wait for revision #2 or #3.
     
  14. macTW Suspended

    Joined:
    Oct 17, 2016
    #15
    The entire situation smells fishy. Add this quote in and it proves it’s fake. If he gets in once, it learns his face better. Not rejects it later.
     
  15. JamieLannister macrumors regular

    JamieLannister

    Joined:
    Jun 10, 2016
    #16
    makes absolute sense. Typing in my 16 digit alphanumeric symbolized password while trying to checkout with apple pay at a register. Make as much as sense as paying $1k+ for a phone.
     
  16. sunapple macrumors 65816

    sunapple

    Joined:
    Jul 16, 2013
    Location:
    The Netherlands
  17. Avieshek, Nov 14, 2017
    Last edited: Nov 14, 2017

    Avieshek macrumors 6502a

    Avieshek

    Joined:
    Dec 7, 2013
    Location:
    India
    #18
    Maybe, there was too much pressure from the government but there was also their (Apple's) reputation.
    Face ID works as a middle ground. As much as, permanently scrap Touch ID and call it a progress. Secure hardware & software wise while also allowable to crack.
     
  18. macTW Suspended

    Joined:
    Oct 17, 2016
    #19
    Uhm... the facts we have suggest Face ID is much more secure than Touch ID.

    Sorry the facts get in the way of your biased opinion.
     
  19. now i see it macrumors 65816

    Joined:
    Jan 2, 2002
    #20
    Face ID is much more secure than Touch ID*

    *except when it isn't
     
  20. macTW Suspended

    Joined:
    Oct 17, 2016
    #21
    You can’t have everything. Sorry.

    There are opportinuty costs in life. Want convenience with some security? Use Face ID. Want total security? Use a long alphanumeric password. Want pure, unadulterated security? Get off the grid.
     
  21. madKIR macrumors 6502

    Joined:
    Feb 2, 2010
    Location:
    NYC
    #22
    I can't believe that mask video is still making the rounds! They don't even show how they set up Face ID in the first place. Most likely they set it up by using that mask and turning off Require Attention feature.
     
  22. bartolo5 macrumors member

    Joined:
    May 11, 2008
    #23
    Maybe first pass was trained with mother and second pass was trained with son? That could trip Face ID up
     
  23. verniesgarden macrumors 6502a

    verniesgarden

    Joined:
    May 29, 2007
    Location:
    Portland, Or
    #24
    Non of them are anymore secure than a passcode since you can still unlock with one.
     
  24. rishic89 macrumors newbie

    rishic89

    Joined:
    Nov 9, 2017
    Location:
    TEXAS
    #25
    True depth system not changing in 2018.
     

Share This Page