Apple Shares In-Depth Security Info on Face ID in New White Paper and Support Doc

[MacRumors]

Apple has already shared many details on the upcoming Face ID facial recognition feature in the iPhone X through its software engineering chief Craig Federighi, who did several interviews, but now the company has consolidated that information into a new support document and an in-depth security white paper released this morning. [PDF]

If you've been paying attention to Federighi's interviews and all of the Face ID coverage on sites like MacRumors, you may already be familiar with the content of the support document, but it does a good job addressing all common questions and concerns in a single spot.

It outlines the way Face ID works, the conditions in which it works - in the dark, with sunglasses, with hats, etc., and how it's set up, along with security information, including the conditions that will lead to Face ID being disabled:

- The device has just been turned on or restarted.
- The device hasn't been unlocked for more than 48 hours.
- The passcode hasn't been used to unlock the device in the last six and a half days and Face ID hasn't unlocked the device in the last 4 hours.
- The device has received a remote lock command.
- After five unsuccessful attempts to match a face.
- After initiating power off/Emergency SOS by pressing and holding either volume button and the side button simultaneously for 2 seconds.

Face ID, as Apple has said, adapts to changes in appearance, and the document gives a bit more info on that topic. If there is a major change in appearance, like the disappearance of a full beard or a significant haircut, Apple will require a passcode and then update the stored facial data accordingly once your identity is confirmed.

It also covers privacy, explaining that Face ID is just like Touch ID: protected by the Secure Enclave and handled all on-device, using years of established security protocols. Accessibility and safety are also topics Apple addresses.

In fact, developers do not need to update their Touch ID apps for those apps to work with Face ID because the systems are the same.

The TrueDepth camera system will not cause harm to eyes or skin, says Apple, and if damage is caused to the infrared emitters, the camera will be disabled. Apple warns that repairs will need to be conducted by Apple or an authorized service provider, which should not come as a surprise as the same applies to the Touch ID home button.

The white paper, meanwhile, explains in better detail exactly how the TrueDepth camera and the A11 Bionic processor in the iPhone X work together to accurately identify a face and avoid spoofing.

To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. A portion of the A11 Bionic chip's neural engine--protected within the Secure Enclave--transforms this data into a mathematical representation and compares that representation to the enrolled facial data. This enrolled facial data is itself a mathematical representation of your face captured across a variety of poses.

Anyone who plans to buy an iPhone X and has questions about how the Face ID feature on the device works should take a look at both the support document and the white paper, as both together answer many questions on security and functionality.

Face ID will become available to the public starting on November 3, the official launch date for the iPhone X.

Article Link: Apple Shares In-Depth Security Info on Face ID in New White Paper and Support Doc

 

[iShater]

That is all interesting and stuff, but why remove the TouchId option?

 

[Ds6778]

It also fails if youre Craig during a keynote.

 

[840quadra]

Hopefully this will resolve some of the confusion, and incorrect information being spread about their technology. Listened into a few podcasts and read some articles that appeared to be conflicting / unclear.

 

[TigerWoodsIV]

I thought it was 2 failed attempts? Also, weird that I'll have to putt my passcode in once a week no matter what. Seems odd it locks it after 4 hours of inactivity and 6.5 days without entering a passcode. People have to sleep.

 

[jgbr]

So touch ID will still be faster LOL

 

[44267547]

It also fails if youre Craig during a keynote.

Face ID never failed during the event. It did exactly what it was supposed to do, and revert to a passcode option because others handled the iPhone before Craig did, which locked him out. The only thing that failed was the actual demo to the audience, not Face ID itself.

 

[gigapocket1]

I thought it was 2 failed attempts? Also, weird that I'll have to putt my passcode in once a week no matter what. Seems odd it locks it after 4 hours of inactivity and 6.5 days without entering a passcode. People have to sleep.

I don’t think it’ll require it after 4 hours... i believe both conditions have to met. It says 6.5 days AND 4 hours of not using face id to unlock a device.. your way it would have said Or instead of And

 

[soupcan]

That is all interesting and stuff, but why remove the TouchId option?

Because Apple couldn't figure out in time how to put the TouchID sensor under the screen.

 

[Rogifan]

Because Apple couldn't figure out in time how to put the TouchID sensor under the screen.

Not true.

 

[gaximus]

Not true.

Reference?

 

[Rogifan]

That is all interesting and stuff, but why remove the TouchId option?

Why do you need two options? Seems confusing and more expensive for what gain?
[doublepost=1506532063][/doublepost]

Reference?

Craig Federeghi’s interview with John Gruber. He said Touch ID was plan B and once they got Face ID working they stopped working on Touch ID.

 

[zakarhino]

Right so that clears up why children under the age of 13 aren't allowed to use it:

"The probability of a false match is different for twins and siblings that look like you as well as among children under the age of 13, because their distinct facial features may not have fully developed. "

 

[RealKrS]

I'm still not buying the whole "Face ID is so much easier and better than Touch ID" that Apple is trying to sell.
What do I do if I tap the screen just to check out the time while my phone is on my desk, then walk away? Is my phone now unlocked?
What if someone takes my phone, ask me to look up? Now do I have to quickly cover my face so that my phone doesn't end up unlocked?
Looks like I'm gonna sit that one out, and wait next iPhone release. Can't wait for that Keynote with the whole gang explaining how revolutionary that new iPhone is, combining Face/Touch ID..

 

[Phil A.]

There are a couple of edge cases that aren't addressed here: the first is currently multiple people can register their fingers and unlock the phone but FaceID will it register a single face
The second is connected somewhat and that is if it automatically updates the face details, what happens if someone other than the owner unlocks the phone with a PIN while looking at the phone - will it update to use their face for recognition?

This would potentially be an issue for me as I know my wife's passcode and she knows mine in case we need to access the other's phone (for example, if I'm driving and an important email comes through she will read it to me and reply if necessary)

As I said, they are edge cases but I'd like to know how they would be handled

 

[citysnaps]

That is all interesting and stuff, but why remove the TouchId option?

It's an unnecessary extra cost that also takes valuable space inside the phone.

 

[joeblow7777]

That is all interesting and stuff, but why remove the TouchId option?

Because there's no place to physically put it.

 

[69Mustang]

Why do you need two options? Seems confusing and more expensive for what gain?

I think you mean why do you need 3 options. The phone already has 2 options, passcode and Face ID.

The funny thing? If you ask your question based on passcode and Face ID, you come up with the same answer: Seems confusing (6 page white paper) and more expensive (that new hard to manufacture module ain't cheap) for what gain?

 

[buckwheet]

I'm still not buying the whole "Face ID is so much easier and better than Touch ID" that Apple is trying to sell.
What do I do if I tap the screen just to check out the time while my phone is on my desk, then walk away? Is my phone now unlocked?
What if someone takes my phone, ask me to look up? Now do I have to quickly cover my face so that my phone doesn't end up unlocked?
Looks like I'm gonna sit that one out, and wait next iPhone release. Can't wait for that Keynote with the whole gang explaining how revolutionary that new iPhone is, combining Face/Touch ID..

Well, you're going to be waiting for the rest of your days. Whatever the state of development currently, the bigger idea of Face ID, I'd imagine, will be to remove the idea of "unlocking" entirely, and simply have a continuous verification of the user. So, if someone unlocks your phone, in whatever way, the phone will quickly recognize that it's not the correct user, and just lock again. Apple isn't trying to "sell" you on the idea that it's better; it simply is better...

 

[EdT]

What if someone takes my phone, ask me to look up? Now do I have to quickly cover my face so that my phone doesn't end up unlocked?

What if you're sleeping and they take your iPhone 6, 6s or 7 and unlock it by holding your thumb on Touch ID? What if they have hi res cameras in the room and just watch what password you enter when you start the phone? Or what if they take your phone, point a weapon at you and demand you tell them your password, so you can't trigger the emergency lock or auto 911?

There isn't a security system that can't be defeated by someone, in some way. It may require lots of money, being sneaky, getting the owner drunk or brute force but it can be done.

 

[lowendlinux]

There are a couple of edge cases that aren't addressed here: the first is currently multiple people can register their fingers and unlock the phone but FaceID will it register a single face
The second is connected somewhat and that is if it automatically updates the face details, what happens if someone other than the owner unlocks the phone with a PIN while looking at the phone - will it update to use their face for recognition?

This would potentially be an issue for me as I know my wife's passcode and she knows mine in case we need to access the other's phone (for example, if I'm driving and an important email comes through she will read it to me and reply if necessary)

As I said, they are edge cases but I'd like to know how they would be handled

I'll be that when the phone is unlocked using the pin the camera is off. It would seem for security sake they wouldn't want both running at the same time and Apple isn't going to release something unsecure after a loud public battle with the FBI.

 

[RealKrS]

What if you're sleeping and they take your iPhone 6, 6s or 7 and unlock it by holding your thumb on Touch ID? What if they have hi res cameras in the room and just watch what password you enter when you start the phone? Or what if they take your phone, point a weapon at you and demand you tell them your password, so you can't trigger the emergency lock or auto 911?

There isn't a security system that can't be defeated by someone, in some way. It may require lots of money, being sneaky, getting the owner drunk or brute force but it can be done.

You kind of proving my point with your response. The way you put it, it looks much harder to unlock my iPhone 6, 6s or 7 than iPhone X with Face ID

 

[Ries]

Face ID never failed during the event. It did exactly what it was supposed to do, and revert to a passcode option because others handled the iPhone before Craig did, which locked him out. The only thing that failed was the actual demo to the audience, not Face ID itself.

Yeah it did. He looked at it, it failed. He turned the screen off and on again to reset the try and then it failed again and asked for the code as per spec on the second fail.

 

[mi7chy]

Face ID never failed during the event. It did exactly what it was supposed to do, and revert to a passcode option because others handled the iPhone before Craig did, which locked him out. The only thing that failed was the actual demo to the audience, not Face ID itself.

Wrong...

 

[44267547]

Yeah it did. He looked at it, it failed. He turned the screen off and on again to reset the try and then it failed again and asked for the code as per spec on the second fail.

Wrong. Federighi himself confirmed exactly what happened, which was reiterated during the Keynote.

http://www.businessinsider.com/face...g-federighi-during-apples-presentation-2017-9