Apple's Craig Federighi Answers Face ID Questions in New Interview

[alleggerita]

I seriously don’t get the concern of robbers getting hold of your phone or even unlocking it with your face and running away. They can run all they like, but my banking app will still need to authenticate my face and might even ask for 2FA using the dongle.

If they try to go to my settings and disable Face ID, they will need to key in my passcode, which without it you can’t disable Face ID or the passcode itself for that matter.

Honestly, the thief will only be able to admire my photo albums, play my songs and games and use my photography app and so on. I mean I’m not a criminal or someone very important. I’ve nothing incriminating in my phone. And like someone mentioned, just ask around for someone else with an iPhone and use Find My iPhone to disable it while the thief is still running.

 

[You are the One]

There is one aspect that I offer is missed when it comes to integrity and privacy and the collection of biometric information on a large scale.

The platform/ecosystem that include biometric information is designed for security and privacy according to current Apple policies and the current legal systems in most countries.

Those may change rapidly, let's say the maniacs in D.C. decides it's time for a "State of Emergency". The dictatorship is out of the closet and very eager to use whatever tools available to control the now "official" slaves. Information will likely continue to be their tool of preference as it works flawlessly in the current obscured dictatorship.

One question is, how future proof is the biometric information that is collected today? another is, what would it take from a technical and resource point of view to tune the present platform/ecosystem to something really malign? It would be interesting to know if Apple include aspects like this in the architecture design. And what their scenarios are...

 

[alleggerita]

There is one aspect that I offer is missed when it comes to integrity and privacy and the collection of biometric information on a large scale.

The platform/ecosystem that include biometric information is designed for security and privacy according to current Apple policies and the current legal systems in most countries.

Those may change rapidly, let's say the maniacs in D.C. decides it's time for a "State of Emergency". The dictatorship is out of the closet and very eager to use whatever tools available to control the now "official" slaves. Information will likely continue to be their tool of preference as it works flawlessly in the current obscured dictatorship.

One question is, how future proof is the biometric information that is collected today? another is, what would it take from a technical and resource point of view to tune the present platform/ecosystem to something really malign? It would be interesting to know if Apple include aspects like this in the architecture design. And what their scenarios are...

I believe the terrorist with the iPhone 5c awhile back shedded some light on this issue. If we were to trust Apple, they built no backdoors into their system. So I would assume Apple has no way of retrieving the mathematical representation of your face from the Secure Enclave too. Though in all hindsight, if so compelled, I’m sure Apple can build a backdoor into it in a short amount of time. But even after retrieving the mathematical representation of your face from the Secure Enclave, there’s the matter of reverse engineering it into an actual mapping of your face. Which, according to Apple, is impossible. Once again we would have to trust Apple on that.

 

[BWhaler]

I bet faceid is going to,be awesome.

I like Touch I’d, so,I hope,it comes back. Maybe I will get send to not,having it. Time will tell.

 

[DeepIn2U]

I seriously don’t get the concern of robbers getting hold of your phone or even unlocking it with your face and running away. They can run all they like, but my banking app will still need to authenticate my face and might even ask for 2FA using the dongle.

If they try to go to my settings and disable Face ID, they will need to key in my passcode, which without it you can’t disable Face ID or the passcode itself for that matter.

Honestly, the thief will only be able to admire my photo albums, play my songs and games and use my photography app and so on. I mean I’m not a criminal or someone very important. I’ve nothing incriminating in my phone. And like someone mentioned, just ask around for someone else with an iPhone and use Find My iPhone to disable it while the thief is still running.

Hmm.
Let's suppose said Criminal Mind got your face and your iPhone X unlocked running off.
You've forgotten what's most important to you ... like many in this world they think ONLY of their finances!

1. Social Media / Web / etc
- you said they have access to your pictures ... well let's edit those and upload them to FB, IG, SnapChat. Let's add a few local ********s (since your male, ummm) heck why not a few chippendales and callguys (? is that p.c.) to your profile, call logs and SMS.
1b. Is this a corporately owned phone?
- EMM/MDM managed, billing from carrier - documented, mined, sourced at any time.
^ something i learned to get what I wanted and needed hehe. was a great and sneaky plan worked perfectly; they only know what YOU want them to see and know.

2. Phone Book
- Corporate contacts, GAL lookup and used.
- let's call that significant other to WRECK SHIP!!
- LORD FORBID you have a child/children in public school !!!! I'm not going to go there - too sensitive as I know a friend that had a scare and makes my stomach turn everytime I think about it! use your imagination of calling the school on this.
> easy to find out about a person's role and anything they do for the company publicly.

That's just the tip. All the while you don't care and not chasing the Criminal Mind ... taking your time to check your wallet/purse, ahem bank account, credit cards, then making the trip to Apple or the police to have situation documented etc then for replacement phone.

THIS is what PRIVACY SHOULD mean to people ... NOT your stupid finances cause these are things that CANNOT be replaced and takes forever to recover and build from. Once destroyed those finances dry up VERY quickly as there is no replenishment. Again consider what is REALLY important in your life, not your wallet.

 

[Mac 128]

I seriously don’t get the concern of robbers getting hold of your phone or even unlocking it with your face and running away. They can run all they like, but my banking app will still need to authenticate my face and might even ask for 2FA using the dongle.

If they try to go to my settings and disable Face ID, they will need to key in my passcode, which without it you can’t disable Face ID or the passcode itself for that matter.

Honestly, the thief will only be able to admire my photo albums, play my songs and games and use my photography app and so on. I mean I’m not a criminal or someone very important. I’ve nothing incriminating in my phone. And like someone mentioned, just ask around for someone else with an iPhone and use Find My iPhone to disable it while the thief is still running.

It isn't really. Federighi made it one by legitimizing the reporters question by explaining the security features in that context. What he should have domes was pointed out how secure the phone already is, and suggesting a victim cooperate fully in a holdup situation as a result. Then explained some other security features like FaceID lock which really applies to a law enforcement situation.

There's potentially a lot of social engineering information to be gleaned from an unlocked phone, but not likely anything worth the extra effort to unlock a stolen phone for 98% of people.

 

[antiprotest]

I thought the same thing. Someone leaves their phone out and you raise it and look. Might be a little more difficult/time consuming to do if you have to do it 5 times, instead of just twice like first reports had it. I wonder if the number of validation tries was changed because of the demonstration.

I do this with people Touch ID all the time and I don't even have to pick up the phone or attract any attention. It is so quick and quiet to mess with people's Touch ID.

 

[Saltman911]

Face ID, Apple's new facial recognition feature in the iPhone X, has left users with a lot of questions about how it works. While Apple has offered detailed explanations of Face ID on its website, there continue to be questions and concerns given that this is a new biometric system.

To answer some of those questions, Apple software engineering chief Craig Federighi did a telephone interview with TechCrunch, where he covered topics on privacy, security, and functionality.

TechCrunch's Matthew Panzarino, who spoke to Federighi, says he's heard Face ID is "incredibly reliable" and "very fast," worth noting because many people have wondered how quickly it works.

According to Federighi, Face ID needs to see your eyes, nose, and mouth, so there are some situations where it won't work and a passcode will need to be used instead. The limitations are similar to the limitations with Touch ID, which, for example, prevent it from being used with gloves.

"If you're a surgeon or someone who wears a garment that covers your face, it's not going to work," says Federighi. "But if you're wearing a helmet or scarf it works quite well."

Panzarino asked Federighi to expand on how the feature works with sunglasses and whether polarization is an issue, following confirmation earlier this week that Face ID is compatible with most pairs. Federighi says polarization isn't a problem, but there are some lenses that have a coating that blocks IR, and if that's the case, a customer will need to use a passcode or take them off.

Face ID will work from multiple angles and distances when a device is held at a natural angle, but it needs to see your face.When it comes to security, Apple says that all Face ID processing is done on device with nothing uploaded to the cloud or Apple's servers, a point Federighi reiterated in the interview. Apple collects no data when the TrueDepth camera in the iPhone X scans your face, and the feature that allows Face ID to adapt to appearance changes is done entirely on device.

"We do not gather customer data when you enroll in Face ID, it stays on your device, we do not send it to the cloud for training data," he said.

When it comes to law enforcement requests for Face ID data, Apple has no data to provide. Your Face ID scan is converted into a mathematical model in the Secure Enclave on the iPhone X, and it can't be reverse engineered back into a face. As with Touch ID, none of that data is ever sent to Apple. Third-party developers don't have access, either.

Federighi also expanded a bit on the method Apple implemented to discretely disable Face ID in a situation where someone might steal your phone and attempt to unlock it with your face. On the iPhone X, holding down on the buttons on either side of the device goes to the power down screen, which also disables Face ID. If someone demands your phone, squeeze the buttons to disable Face ID, Federighi suggests.

Face ID will also disable itself after five failed attempts at recognition. Earlier this week, Apple documentation suggested it would be disabled after two failed recognition attempts, but Federighi has clarified that it's five, just like Touch ID. Apple's documentation has now been updated accordingly. Also, when the iPhone reboots or Face ID hasn't been used in 48 hours, a passcode will be required. Additionally, if you haven't entered a passcode for 6.5 days and Face ID hasn't been used in the last four hours, Face ID will also be disabled until a passcode is entered.

Federighi's full interview, which includes more details on how Apple trained Face ID and how it works, can be read over at TechCrunch.

Article Link: Apple's Craig Federighi Answers Face ID Questions in New Interview

[doublepost=1505621827][/doublepost]If anyone else was wondering like I was… Craig actually wrote me back!

 

[alleggerita]

Hmm.
Let's suppose said Criminal Mind got your face and your iPhone X unlocked running off.
You've forgotten what's most important to you ... like many in this world they think ONLY of their finances!

1. Social Media / Web / etc
- you said they have access to your pictures ... well let's edit those and upload them to FB, IG, SnapChat. Let's add a few local ********s (since your male, ummm) heck why not a few chippendales and callguys (? is that p.c.) to your profile, call logs and SMS.
1b. Is this a corporately owned phone?
- EMM/MDM managed, billing from carrier - documented, mined, sourced at any time.
^ something i learned to get what I wanted and needed hehe. was a great and sneaky plan worked perfectly; they only know what YOU want them to see and know.

2. Phone Book
- Corporate contacts, GAL lookup and used.
- let's call that significant other to WRECK SHIP!!
- LORD FORBID you have a child/children in public school !!!! I'm not going to go there - too sensitive as I know a friend that had a scare and makes my stomach turn everytime I think about it! use your imagination of calling the school on this.
> easy to find out about a person's role and anything they do for the company publicly.

That's just the tip. All the while you don't care and not chasing the Criminal Mind ... taking your time to check your wallet/purse, ahem bank account, credit cards, then making the trip to Apple or the police to have situation documented etc then for replacement phone.

THIS is what PRIVACY SHOULD mean to people ... NOT your stupid finances cause these are things that CANNOT be replaced and takes forever to recover and build from. Once destroyed those finances dry up VERY quickly as there is no replenishment. Again consider what is REALLY important in your life, not your wallet.

Ok you’ve got your point there. But with so many people using an iPhone. I’m sure a passerby next to you is using one, if not the next one. Just borrow their phone to use Find My iPhone to lock/wipe your phone. It’ll take less than a min if he/she has the app installed.

 

[Piggie]

I wonder how "In-Car" will work?

How does it work now for Sat Nav and other such uses ?

Everyone I have seen with a phone on their car has it held in some cradle that it off to the side of the steering wheel/centre console.

Such as like this:

Or on the windscreen, or on top of the dash.

Of course, you can just reach over and touch the Touch-ID to activate your phone in a second.
Just as you would adjust a radio dial or air vent.

Wonder how Face-ID will work in such a in-car scenario ?

 

[roeiz]

people sure seem rather paranoid here..
who the hell will want my lousy stuff i got in my phone?
oh yea i will be kidnapped and held in front of the phone so they could "get my stuff"!

i'm sure that people who NEED their phone to be extra secured,
takes long measures to have their personal stuff protected.

 

[Nhlanhlo]

Did Apple really think of everything and everyone?

 

[Piggie]

Did Apple really think of everything and everyone?

I did think about these people myself when this was 1st talked about.
But I understand this is IR light, which I understand will pass thru most fabrics, so such a face covering may not cause an issue.
And you can get, due to recent media coverage of these garments that Apple have thought about this and the press they would get if face ID failed to work with these women.

It will be interesting to see it tested as you can be sure it will be tested when it gets released with these face coverings.

My guess it, it will work, dependent on the type and thickness of the material.

 

[Pilgrim1099]

I wonder how "In-Car" will work?

How does it work now for Sat Nav and other such uses ?

Everyone I have seen with a phone on their car has it held in some cradle that it off to the side of the steering wheel/centre console.

Such as like this:

Or on the windscreen, or on top of the dash.

Of course, you can just reach over and touch the Touch-ID to activate your phone in a second.
Just as you would adjust a radio dial or air vent.

Wonder how Face-ID will work in such a in-car scenario ?

Most cradles have a fixed position straight out which I don't like. The one I use is a goose neck cradle attached to the cigarette lighter which is cheaper and gets the job done. If one wants to use Face ID, they need to have a cradle that has 180 degree rotation and swivel capabilities so the device can turn to face the driver ( as long as the bolt is tightened for the cradle to stay in that position ). It's the only solution.

Otherwise, that can be dangerous looking at the phone while driving which is not recommended. As long as it's 'hands free', it's legit in this state I live at. It's illegal to text and drive with the device on your hand while in motion, the exception would be stop lights, parking lots, or parked at a safe spot to communicate.

 

[Piggie]

Most cradles have a fixed position straight out which I don't like. The one I use is a goose neck cradle attached to the cigarette lighter which is cheaper and gets the job done. If one wants to use Face ID, they need to have a cradle that has 180 degree rotation and swivel capabilities so the device can turn to face the driver ( as long as the bolt is tightened for the cradle to stay in that position ). It's the only solution.

Otherwise, that can be dangerous looking at the phone while driving which is not recommended. As long as it's 'hands free', it's legit in this state I live at. It's illegal to text and drive with the device on your hand while in motion, the exception would be stop lights, parking lots, or parked at a safe spot to communicate.

Yes, a Bendy Stalk.
For driving, probably a little safer to just reach out and press on a button than to LOOK at a phone correctly and swipe up.

 

[EdT]

I did think about these people myself when this was 1st talked about.
But I understand this is IR light, which I understand will pass thru most fabrics, so such a face covering may not cause an issue.
And you can get, due to recent media coverage of these garments that Apple have thought about this and the press they would get if face ID failed to work with these women.

It will be interesting to see it tested as you can be sure it will be tested when it gets released with these face coverings.

My guess it, it will work, dependent on the type and thickness of the material.

I think a burka would prevent it from working. Infra red can go through clothing, but the infrared dots being placed on your face with the iPhone can't be very powerful at all, or the device could quickly drain your battery. Plus, having to go through material is likely to break up the dots into general unfocused IR light. And the light must travel twice through the clothing, first to hit the face of the person trying to unlock and then back to the iPhone.

 

[extrachrispy]

How about don't use your phone while riding a motorbike?

Anyway, it's funny to see Apple in full-on PR damage control mode.

Scenario: I'm on my motorcycle, and my iPhone is in my coat pocket, connected to my bluetooth helmet intercom. I can receive calls, but I cannot dictate texts or make a quick call via bluetooth (e.g., to let someone know I'm safe, or, while droning on an empty road, to make a hotel reservation ahead), unless I disable ALL security features and keep the phone completely unlocked.

I've asked Apple to allow me the ability to dictate the passcode to the phone to unlock it in this case, but they have declined.

when connected to bluetooth_device with ID foo

allow passcode_dictation​

That's it. That's all I would need.

 

[msandersen]

So on my motorcycle.

Previous: Take off right hand leather glove use phone.

The Future: Take off right hand leather glove, Take off glasses, take off full face crash helmet, LOOK at phone, use phone, put crash helmet back on, put glasses back on.

...or do it the old-fashioned way, keep your helmet and glasses on, and just use the passcode. Not as convenient as TouchID, but not by much. BTW, as mentioned elsewhere, it is said to work with glasses and most sunglasses, but obviously a full-face helmet won't work.

 

[unobtainium]

Scenario: I'm on my motorcycle, and my iPhone is in my coat pocket, connected to my bluetooth helmet intercom. I can receive calls, but I cannot dictate texts or make a quick call via bluetooth (e.g., to let someone know I'm safe, or, while droning on an empty road, to make a hotel reservation ahead), unless I disable ALL security features and keep the phone completely unlocked.

I've asked Apple to allow me the ability to dictate the passcode to the phone to unlock it in this case, but they have declined.

when connected to bluetooth_device with ID foo

allow passcode_dictation​

That's it. That's all I would need.

Passcode dictation would be nice in certain settings, but Apple is probably concerned about the chance of someone overhearing you speaking your password. Not likely on a motorbike, but that's a niche scenario, IMO.

 

[gnasher729]

I believe the terrorist with the iPhone 5c awhile back shedded some light on this issue. If we were to trust Apple, they built no backdoors into their system. So I would assume Apple has no way of retrieving the mathematical representation of your face from the Secure Enclave too. Though in all hindsight, if so compelled, I’m sure Apple can build a backdoor into it in a short amount of time.

The nice thing about Secure Enclave is that there is _no way_ to get any information out of it. Impossible. Changing the firmware of the phone doesn't help, and the firmware on the secure enclave cannot be changed. Nothing that Apple can do. In addition, you can't change the firmware without the user unlocking the phone first which means you need the face...

 

[Tech198]

If your worried abut anything leaving your phone, when u use Face ID, stick your phone Airplane mode before you lock it.... If u can still use FaceID... Success..

And if u can't ....well someone lied...

 

[MacsRuleOthersDrool]

So on my motorcycle.

Previous: Take off right hand leather glove use phone.

The Future: Take off right hand leather glove, Take off glasses, take off full face crash helmet, LOOK at phone, use phone, put crash helmet back on, put glasses back on.

Or, just take off glove, use Passcode. Use phone.
[doublepost=1505720847][/doublepost]

Hypothetical, yet (IMO) plausible scenario: law enforcement, or for that matter anyone, only has to point your phone at your face to unlock it?

Doesn't work that way.

You have to be paying attention to the phone. Eyes open, and assertively looking at the phone. So, just look to the side or close your eyes if they try that.

Or use the "Panic Button" before handing the phone over.
[doublepost=1505721522][/doublepost]

Exactly.... Take your phone, handcuff you and point it at your face.... Done deal.

Wrong.

Read the thousand or so posts that explain why this won't work.

 

[citysnaps]

Those numbers actually don't mean anything. They said 1 in 50,000 people could authenticate using another person's touch id data. And 1 in 1,000,000 people for face id. However, Apple didn't say how easy Face ID would be to crack using other means. It seems reasonable it will be easier to fool than a finger print id since it is using visual data. However, that doesn't mean it will be likely it can be done.

Absolutely not true. Please try and understand how facial features/data are collected.

 

[mac_in_tosh]

Are we at the point where phone companies are just adding features in order to differentiate from last year's product but those features are not necessarily better e.g. face vs. fingerprint recognition?

 

[thebeans]

you don't need to do the BOLDED with face ID.

Yes you do. Unless you plan on interacting with your phone using your nose or some other body part. Unless you have touch active gloves and I don't know if they make motorcycle gloves that are touch active .