Apple Shares In-Depth Security Info on Face ID in New White Paper and Support Doc

[springsup]

This won’t stop ignorant big mouths like Al Franken, who somehow have established themselves in a powerful political position w/ regards to cyber security... a field which he literally knows less than nothing about!
Lol, it was cringingly embarrassing reading his “open letter” to Apple, concerning FaceID... in describing the technology, he states his belief that iPhones will have precise 3D models of ones face, that will then be able to be accessed remotely & there’s a chance of a hacker database being built, of perfect replicas of people’s faces.
What a nincompoop!
Hasn’t it been like five years since these “concerns” were raised about TouchID??
By now, even someone with a passing curiosity & the most basic understanding of technology could find out in 5 minutes, via Google, that actually a copy of your fingerprint is NEVER stored on an iPhone... rather, a map of random data points & their distance from each other, etc. so that the phone can see if it’s you without having a “photo” of your fingerprint.
Common sense would tell you (then Craig would even tell you again!) that this works similarly...

I’m perfectly happy for legislators to ask directly about these concerns. We can’t expect them all to be technology experts, and it’s better that they get the facts rather than continuing any misconceptions they might have.

In this case, I don’t know. If the stored mathematical model is able to match against random dot projections, perhaps it is indeed possible to repeatedly probe it until you have a detailed model of a persons face. Who could answer that question? Probably somebody at Apple.

Hackers are very resourceful, and they don’t need to “cleanly” defeat the technology - they’ll take any hack that works. Smartphones are also targeted by state actors who have significant resources (including the US Governments own agencies). So it’s not as stupid a question as you might initially assume.

 

[kdarling]

Wrong. Federighi himself confirmed exactly what happened, which was reiterated during the Keynote.

Looking at the video, even I (a forum supporter of Face Id before almost anyone else) later realized that phone was not already passcode locked when he picked it up.

This won’t stop ignorant big mouths like Al Franken, who somehow have established themselves in a powerful political position w/ regards to cyber security... a field which he literally knows less than nothing about!

That's why they write lists of questions and give companies an official opportunity to explain and promote their security.

Lol, it was cringingly embarrassing reading his “open letter” to Apple, concerning FaceID... in describing the technology, he states his belief that iPhones will have precise 3D models of ones face, that will then be able to be accessed remotely & there’s a chance of a hacker database being built, of perfect replicas of people’s faces.

Franken didn't say he believed any of that was possible now. He expressed concern about whether or not a hacker could get access.

He asked if it was possible for third parties to access the info, if the face image was stored anywhere, and what security Apple would use if/when they ever decided they needed to push the data to a server.

Pretty much the same questions that half the forum here asked. Don't you remember all the posts asking if this meant NSA would have copies of our faces? So he was doing what a representative is supposed to do: ask the same questions that his constituents are asking.

Here's his letter: https://www.franken.senate.gov/?p=press_release&id=3759

 

[MistrSynistr]

Read it and also remember to not believe one phukking thing in it.

 

[Stewie]

Hopefully this will resolve some of the confusion, and incorrect information being spread about their technology. Listened into a few podcasts and read some articles that appeared to be conflicting / unclear.

You would think so, but reading some of the comments here it seems people have made up their minds already and no amount of facts or data will convince them otherwise.

 

[T-Will]

Good to hear FaceID will work with some sunglasses!

 

[WatchFromAfar]

Am I the only one who read this line?

"If there is a major change in appearance, like the disappearance of a full beard or a significant haircut, Apple will require a passcode and then update the stored facial data accordingly once your identity is confirmed."

So your telling me you'll have to do the facial recognition setup often?

I just like the phrase "significant haircut"

 

[Duane Martin]

Am I the only one who read this line?

"If there is a major change in appearance, like the disappearance of a full beard or a significant haircut, Apple will require a passcode and then update the stored facial data accordingly once your identity is confirmed."

So your telling me you'll have to do the facial recognition setup often?

How fast do your beard and hair grow? What part of "major changes" do you not understand? Crap, next people will be bitching they have to reset FaceID after every facelift!

I am appalled at the lack of reading comprehension demonstrated by so many on this forum.

 

[mdelvecchio]

I'm still not buying the whole "Face ID is so much easier and better than Touch ID" that Apple is trying to sell.
What do I do if I tap the screen just to check out the time while my phone is on my desk, then walk away? Is my phone now unlocked?
What if someone takes my phone, ask me to look up? Now do I have to quickly cover my face so that my phone doesn't end up unlocked?
Looks like I'm gonna sit that one out, and wait next iPhone release. Can't wait for that Keynote with the whole gang explaining how revolutionary that new iPhone is, combining Face/Touch ID..

If you wake you X to check the time and it unlocks, simple...wait for it...push the sleep button. Gasp!

You fear-fantasies about people stealing your phone are just ridiculous. Nothing stops people from forcing your fingerprint or password. Stop panicking.
[doublepost=1506546098][/doublepost]

I just like the phrase "significant haircut"

Hair Force One, baby!

 

[Duane Martin]

Face ID will fail precisely when security is needed the most. Then Apple will be doomed.

I believe you posted the exact same thing with the release of TouchID and the iPhone 5s. Was that you?

 

[Russell L]

Just hoping it will work in my situation where I use my iPhone both with and without glasses (and sometimes sunglasses).

 

[EdT]

I just like the phrase "significant haircut"

Great band name. I claim dibs.

 

[Duane Martin]

I'll never understand why people think they can "debunk" billions of dollars in security R&D with a 5-minute armchair analysis of a technology they have never used and don't fully understand. Yet, here we are.

Nailed it right there, so very true. And yet these same people are quick to call Apple "arrogant". Wow.

And by the way, to other forum members, it is not okay to call Federeghi and Gruber liars and without integrity simply because you choose not to believe them. Not cool.
[doublepost=1506548878][/doublepost]

Just hoping it will work in my situation where I use my iPhone both with and without glasses (and sometimes sunglasses).

So your concern is that though FaceID will work with most sunglasses it will fail to work when you take off your glasses? Is that your question? Would you like to take a moment?

 

[840quadra]

Looking at the video, even I (a forum supporter of Face Id before almost anyone else) later realized that phone was not already passcode locked when he picked it up.

At the end of the day people are bickering over a pre-released phone, that nobody here is 100% certain what was, or wasn’t done to it prior to the keynote. We also don’t know the settings enabled on this phone with regards to FaceID reqiring attention, or not.

Personally, I am going to reserve judgement until reviews are out on production models, or, I have a chance to test it myself.

 

[kdarling]

And by the way, to other forum members, it is not okay to call Federeghi and Gruber liars and without integrity simply because you choose not to believe them. Not cool.

Apple execs very commonly use clever word crafting, in order to give the appearance that they said something they really didn't. They got this tendency from Jobs, who was a master at it. It's in their DNA now, you might say.

In other words, they always tell the truth. Just not the whole truth. They know that the best way to hide something they don't want to admit, is to throw in a piece of true info.

For instance, back when the NSA Prism program came to light, along with slides showing that Apple had joined up in 2012 (interestingly, after Jobs died), Apple put out an official press release saying that they had never "heard of the government's Prism program" before being asked by reporters about it. Slick wording, but all that means is that they didn't know the NSA code name for what they were already doing. Of course, gullible people misread it to mean that Apple wasn't part of it, a misconception that Apple intended.

Antennagate was another example of extreme handwaving by Apple and Jobs. Ditto Bendgate.

So I don't think anyone can call them outright liars. But for better or worse, they do have a history of making misleading statements and refusing to take responsibility for major goofs.

 

[gaximus]

No, no. It's telling you that it temporarily stores the facial scan, even for failures. If you successfully authenticate with your passcode very shortly after a failed facial scan, it will use the data from the failed scan to update the model it has for matching your face.
[doublepost=1506543464][/doublepost]
All of those cite anonymous sources. Meanwhile, named, highly-placed sources from the company (namely, Craig Federighi) have said Touch ID was always the backup plan and was abandoned when they got Face ID working how they wanted. Without further evidence, named sources win.

Therefore, not true unless someone provides further evidence which beats a public statement from Craig.

Yes the and the original post didn't explain why its "Not true" I was just asking where that came from. I'm happy with the answer "Craig said so". I wasn't arguing that he was wrong, just wanted to know why it was "not true"

 

[elmaco]

From the PDF document:

An additional neural network that’s trained to spot and resist spoofing defends against attempts to unlock your phone with photos or masks.

This doesn't sound convincing.

If you find out a way to spoof the system that it has not been trained for, you could break in. Once somebody finds out how - there will be millions of attempts - it will published on the Internet and everybody can use it.

 

[kdarling]

All of those cite anonymous sources. Meanwhile, named, highly-placed sources from the company (namely, Craig Federighi) have said Touch ID was always the backup plan and was abandoned when they got Face ID working how they wanted.

Got a link to where he said that? Including a time mark if it's media? Thanks!

 

[flat five]

Also, weird that I'll have to putt my passcode in once a week no matter what. Seems odd it locks it after 4 hours of inactivity and 6.5 days without entering a passcode. People have to sleep.

this same (or similar) rule is in place for TouchID and has been for a long time.. nothing new here.
if you never noticed it with TouchID based phones, you'll never notice it with faceID phones either.

What do I do if I tap the screen just to check out the time while my phone is on my desk, then walk away? Is my phone now unlocked?

if you swipe up, it will unlock and yes, be unlocked when you walk away.. if you just tap it to check the time then no, it won't be unlocked.. (nor will it be unlocked if you swipe down to check notifications)

What if someone takes my phone, ask me to look up? Now do I have to quickly cover my face so that my phone doesn't end up unlocked?

a very unlikely scenario.. it's like saying "what if someone takes my phone and asks me to give them my hand... (or whatever)"
if someone grabs your phone, chances are, they're going to be running down the street and not sticking around to try to get into it.. i mean, what in the world would they be wanting to do with your unlocked phone that you're so worried about? read your email?
(or, maybe i'm misunderstanding your concern?)

 

[Duane Martin]

Apple execs very commonly use clever word crafting, in order to give the appearance that they said something they really didn't...
Antennagate was another example of extreme handwaving by Apple and Jobs. Ditto Bendgate.

Excellent! Accuse someone of a tactic that you immediately then use. "Atennagate", a tempest in a teapot invented on rumour sites because it was great click-bait but it didn't effect the vast majority of users of the iPhone 4 nor sales. "Bendgate" was equally blown out of all proportions (check Consumer Reports). Why? It is worth noting that other phones had attenuated signals when held in specific ways and other phones bent, but those stories don't get the clicks or the vitriol of readers going, do they?

So you have used two of the biggest hoax stories to accuse others of dishonesty. Nice.

 

[Analog Kid]

projects a device-specific random pattern

Does this mean that every phone has a unique dot pattern? Makes you wonder if this is what the manufacturing challenge is with the X.

 

[Ries]

Excellent! Accuse someone of a tactic that you immediately then use. "Atennagate", a tempest in a teapot invented on rumour sites because it was great click-bait but it didn't affect vast majority of users of the iPhone 4 nor sales. "Bendgate" was equally blown out of all proportions (check Consumer Reports). Why? It is worth noting that other phones had attenuated signals when held in specific ways and other phones bent, but those stories don't get the clicks or the vitriol of readers going, do they?

So you have used two of the biggest hoax stories to accuse others of dishonesty. Nice.

Antenna gate isn’t a hoax, never have been. It was measured in a lab, brige the gap and you might as well use a brick as an antenna.

And considering Apple fixed bendgate in the next model...
[doublepost=1506559385][/doublepost]

It did not fail. If it did fail you would have seen the shake thing, indicating face was not recognised. But it asked for password suggestion it had defected unknown faces before. This have been explained and for anyone who knows how Touch ID works is understandable but you will still get the ignorant ones thinking it did fail.

The ignorant one is you, as said many times, if that was the case it would have asked on the first try, not the second.

 

[Sy7ygy]

Hmm.. yes.. quite interesting..

.. still a terrible idea.

 

[jamesrick80]

So it randomizes 2D images to stop spoofs. I thought this was 3D facial recognition.

 

[flat five]

The ignorant one is you, as said many times, if that was the case it would have asked on the first try, not the second.

i thought the first phone was broken and the second one wasn't.. i mean, realistically, that's all we saw..

sure hope i get one that works because Federighi's back-up looked like it worked great, no?
if not, i'll send the broken one back til i get one that works.. then faceID will never not work, right?

-----------------

or maybe, i'll just wait til i use it and others use it... we'll know how good faceID works within a very short time of release day..

whether or not faceID failed during Federighi's demo is going to be hugely irrelevant very soon.. like, it totally doesn't matter what happened on that stage.. what matters is how well it works for the people buying the phones.

like-- on Nov4 when/if some people posts here "wow, faceID is sweet and reliable"(etc), is the retort going to be "no it's not, it failed at the demo" ?
or what?

----
[edit] maybe not so much a reply to you directly Ries.. speaking more in general but used your post as a launching point.
[doublepost=1506560647][/doublepost]

So it randomizes 2D images to stop spoofs. I thought this was 3D facial recognition.

it is.
and you know that.. and you know what you did in your post.
have fun.

 

[macs4nw]

Am I the only one who read this line?

"If there is a major change in appearance, like the disappearance of a full beard or a significant haircut, Apple will require a passcode and then update the stored facial data accordingly once your identity is confirmed."

So your telling me you'll have to do the facial recognition setup often?

Only in about three instances I can think of, off the top of my head:

1. Shaving off a long or thick beard.... gradual hair growth will be recognized and adapted to. (What's on the top of your head is apparently less significant as illustrated by Apple's own info with the person suddenly wearing a headscarf.)

2. Major Plastic Surgery.... different facial features.

3. Wearing of glasses, dark enough to impede the flow of IR light.... in which case you'll have to take them off.

And in cases 1&2 which aren't exactly routine events, it's as simple as a quick re-setup.
Again, the accent is on 'major' in Apple's info.