Google Pixel 4's Face Unlock Feature Works With Eyes Closed, Sparking Security Concerns

[Rogifan]

Again, Google doesn’t know how to design hardware.

Just a few days ago, haters laughed because the Pixel 4 facial unlock was faster than 2 year old FaceID, but it was too early to be so smug.

The only reason it’s allegedly faster is because iPhone requires you swipe up to get to the home screen. I suppose Apple could have a setting to turn that off but I doubt there are many people outside of tech nerds that comment on The Verge complaining that Face ID is too slow.

 

[TopherMan12]

At the end of the day, a PIN is the most secure way to unlock your phone, as long as you don't use 1234 or your birthday. Just about all phones have this ability. But nope, companies like Apple and Samsung won't settle for just a PIN. It's not sexy enough, and not good marketing material. This is not just coming from me - I have a friend who is a coder, and took digital security classes - this is what he was taught.

I believe that my under-display fingerprint scanner in my S10 is actually pretty secure - it requires a rather precise position to work properly, so I don't think someone would be able to easily put my finger on it if, say, I was asleep. And no one could hold the phone up to my face to unlock it, as I don't have facial recognition enabled.

Passcodes are still used in conjunction with FaceID in iPhone. You can disable FaceID and use passcodes only if you choose.

I'm not buying the notion that passcodes are more secure unless they are extremely complex. If I can look over your shoulder and see you type in your passcode then I can at least get an idea of what it is. Researchers have found they can derive passwords from up to 150 feet away.

 

[Frantisekj]

BuT iT's fASter tHaN tHe IphOne

Yeah, they can wipe your bank account really faster! lol

 

[KanosWRX]

Largest over hype I have ever seen.. this is not a big deal at ALL. I couldn't care less if I have to look at it, I turn that off on Apple devices as is... Such click bait.

 

[polbit]

The only reason it’s allegedly faster is because iPhone requires you swipe up to get to the home screen. I suppose Apple could have a setting to turn that off but I doubt there are many people outside of tech nerds that comment on The Verge complaining that Face ID is too slow.

The reason it's fast is because it has a new radar chip that gets everything ready to scan the face before your face is in the frame. Not commentating how good it actually works, but there is new hardware in Pixel 4 that's not present in iPhone to allow for the speed.

 

[lunarworks]

I thought it would be just 1yr for everyone else to replicate the tech inside iPhoneX. But there are not much phones having face ID even after 2 yrs. Then I thought maybe not many are interested in that tech. But now I know, it must be gruesomely difficult and expensive. I mean, someone like Google trying and failing. Can't imagine plight of other small manufacturers.

Most people think it's just a camera looking at your face, but it's much, much more complicated than that.

 

[Alan Wynn]

At the end of the day, a PIN is the most secure way to unlock your phone, as long as you don't use 1234 or your birthday.

That is the problem. Many people cannot remember a PIN or do not want to take the time to enter it, so choose an insecure one or none at all. The benefit of biometrics is improved security over insecure passwords (or none at all) while still providing convenience.

Just about all phones have this ability. But nope, companies like Apple and Samsung won't settle for just a PIN.

Actually, it is users who will not settle for this. Anyone who chooses, can set a password that is long, alphanumeric and secure, and not enable biometric security. Studies show this almost never happens (over 90% use biometric security on phones that offer it).

It's not sexy enough, and not good marketing material. This is not just coming from me - I have a friend who is a coder, and took digital security classes - this is what he was taught.

You get it wrong on two counts. First, many studies showed that before TouchID, a very large percentage of phones had no password at all, or an insecure one, so adding biometric security encourages people to lock their phones improving security. Second, users could choose not to enable biometric security, if they did not want it, but the overwhelming majority do so, indicating that they value the convenience over the loss of optimal security.

I believe that my under-display fingerprint scanner in my S10 is actually pretty secure - it requires a rather precise position to work properly, so I don't think someone would be able to easily put my finger on it if, say, I was asleep. And no one could hold the phone up to my face to unlock it, as I don't have facial recognition enabled.

No, it is not. They would not need your finger, just a screen protector.

 

[polbit]

That's not good for Google. So anyone can unlock your phone when you are sleep.

Yes, and it's a deep, real concern. If someone ever breaks into your home while you are sleeping, your first thought should be, "Gosh, I'm glad I have an iPhone so they won't be able to unlock it until I open my eyes."

 

[Frantisekj]

Whether they can not fix it in software then it is really deal lol. That case with kid is that less dangerous. With Samsung recent flop there comes question. What is difference between "safe" and safe? Millions, tens or hunderds of research millions of dollars.

 

[realtuner]

So is the issue that the Pixel 4 doesn’t have the option of requiring eyes to be open? Because iPhone can unlock with eyes shut if you have require attention turned off.

Android introduced Face Unlock way back in version 4.0 (Jelly Bean). Then it was discovered you could fool it with a picture. So in 4.1 they added Liveness Check which required you to blink in order to prove you were a living person.

Then researchers found they could fool Liveness Check with a pair of photos, one where the “eyelids” were simply painted over the eyes using a color matching your skin tone.


After Google went through all this in the past, how could they not be aware of the issues surrounding closed eyes? It’s not like they’ve never seen this before.

Massive failure.

 

[nims]

Just yesterday, I made a comment of how in a few months, Google will be explaining their Face unlock failures. Turns out, they are explaining 15 hours after that comment, what a joke!

 

[alexandr]

pixel 4. unlocks in a blink of an eye.

 

[Alan Wynn]

Yes, and it's a deep, real concern. If someone ever breaks into your home while you are sleeping, your first thought should be, "Gosh, I'm glad I have an iPhone so they won't be able to unlock it until I open my eyes."

The case is much simpler, as a friend who just ordered a Pixel 4 pointed out, falling asleep on the airplane or in a cafe with your phone on the table in front of you.

 

[M3gatron]

So in order for them to “brag” about how fast it is they need to make it less secure. I wonder what other shortcuts they’ve taken. We’ll have to see if Forbes does their 3D printed face test again, this time with the Pixel.

FaceID is fast AND secure.

Well in all fairness Pixel's 4 facial unlock system is really impressive from a speed point of view.
It's quite obvious it you watch MKBHD's and The Verge's clips(which are the last ones I watched).

The toggle that requires the attention would probably make the unlock process less seamless or fluid.
Like I said, it's possible that Google made a mistake by completely removing that toggle and they will be forced to add it back.

Also taking in consideration that facial unlock is Pixel's 4 only biometric authentication system(that works with mobile payments as well) I suspect it will perform at least just as good in Forbes test.

 

[SoyCapitanSoyCapitan]

Google has ignited security concerns over the facial authentication system in its new Pixel 4 smartphone by admitting that it will unlock the device even when the user's eyes are shut.

Google unveiled the Pixel 4 this week to mostly positive reviews, many of which praised the phone for its super-fast new face unlock system, which replaces the fingerprint sensor and works much the same as Apple's Face ID on iPhones, except for one key security feature.

The BBC has discovered that the Pixel 4 can be unlocked even with the user's face even if they're sleeping (or pretending to be asleep). That contrasts with Apple's Face ID system, which engages by default an "Attention Aware" feature that requires the user's eyes to be open for the iPhone to be unlocked. Attention Aware can be disabled for convenience, but the Pixel 4 lacks an equivalent security feature entirely.

​

To its credit though, Google isn't hiding this fact. A Google support page reads: "Your phone can also be unlocked by someone else if it's held up to your face, even if your eyes are closed. Keep your phone in a safe place, like your front pocket or handbag."

To "prepare for unsafe situations," Google recommends holding the power button for a couple of seconds and tapping Lockdown, which turns off notifications and face recognition unlocking.

In early leaks of the Pixel 4, screenshots revealed a "require eyes to be open" setting for face unlock, so it looks as if Google tried to implement a similar feature to Apple's Attention Aware, but couldn't get it working in time for the device's launch.

Subscribe to the MacRumors YouTube channel for more videos.​

Speaking before the launch, Pixel product manager Sherry Lin said: "There are actually only two face [authorisation] solutions that meet the bar for being super-secure. So, you know, for payments, that level - it's ours and Apple's."

Cyber-security experts disagree.

"If someone can unlock your phone while you're asleep, it's a big security problem," security blogger Graham Cluley told the BBC. "Someone unauthorized - a child or partner? - could unlock the phone without your permission by putting it in front of your face while you're asleep."

In a statement given to the BBC, Google said it would "continue to improve Face Unlock over time."

Article Link: Google Pixel 4's Face Unlock Feature Works With Eyes Closed, Sparking Security Concerns

Its not a bug its a feature for drunk people to ask Google for directions when they can't open their eyes.

 

[farewelwilliams]

In all fairness, it isn't really a regression compared to fingerprint scanners which can also be used with a sleeping user.

What I really like on my Samsung phone is 2-level authentication. It comes with a feature called secure folder that can contain apps and data that is separately encrypted and can have different access security. I use this for my banking apps, and have a password on it instead of the fingerprint/PIN combo for my phone itself.

I don't think the pixel has this though. It's part of Samsung Knox.

a touch on my fingers can easily wake me up. especially when i have my arms folded. it’s a regression

 

[M3gatron]

The only reason it’s allegedly faster is because iPhone requires you swipe up to get to the home screen. I suppose Apple could have a setting to turn that off but I doubt there are many people outside of tech nerds that comment on The Verge complaining that Face ID is too slow.

Actually the Soli chip senses whey your hand gets close to the phone and activates the facial unlock system before you get the chance to touch the phone.
You can even unlock the phone by simply getting your face close to it, so without using your hands at all.
Google's unlock system has additional hardware that is not present in the iphone.

 

[cocky jeremy]

BuT iT's fASter tHaN tHe IphOne

Mostly because it just pretends to scan. lol.

 

[StellarVixen]

Its was quite painful to read the few comments of this thread. Its obvious most users here aren't very well informed.

There's too much drama about this situation when there was already a leaked image that shows an option that says, eyes need to be opened for face authentication to work on the Pixel 4. Most likely Google will introduce the option with the first or second update they push to the Pixel 4.

From the hands on I've seen Google's Face Authentication is very fast(faster than FaceID at first glance) and form a security stand point, it can be used with mobile payments and bank apps so I don't see a problem there.

View attachment 870508

Thank you, I wanted to ask the same, maybe there is some option in the settings, like there is "Require attention" on iPhone.

 

[M3gatron]

Yeah, apparently for some reason Google removed that toggle from the latest Pixel 4 software.

 

[Jim Lahey]

Embarrassing.

 

[realtuner]

Well in all fairness Pixel's 4 facial unlock system is really impressive from a speed point of view.
It's quite obvious it you watch MKBHD's and The Verge's clips(which are the last ones I watched).

The toggle that requires the attention would probably make the unlock process less seamless or fluid.
Like I said, it's possible that Google made a mistake by completely removing that toggle and they will be forced to add it back.

Also taking in consideration that facial unlock is Pixel's 4 only biometric authentication system(that works with mobile payments as well) I suspect it will perform at least just as good in Forbes test.

The speed is irrelevant when FaceID is pretty much instant already. Also irrelevant because the iPhone doesn’t have a toggle to let you go straight to the home screen without swiping so you really can’t accurately compare speeds.

This will be just like 5G. Android users will try and claim a split second difference in time makes all the difference in using your device when it won’t make any difference in actual use.


However, I can understand the desperate need of the Android user to grasp onto anything they can where they appear to have a “win”. Losing in so many areas to the iPhone (privacy, security, Apps/ecosystem, performance, updates, aftermarket support.....) it must be overwhelming at times. So these little victories must seem special.

 

[konqerror]

Actually the Soli chip senses whey your hand gets close to the phone and activates the facial unlock system before you get the chance to touch the phone.
You can even unlock the phone by simply getting your face close to it, so without using your hands at all.
Google's unlock system has additional hardware that is not present in the iphone.

The Apple m-series coprocessor does the exact same thing when you pick up the phone.

Yes, and it's a deep, real concern. If someone ever breaks into your home while you are sleeping, your first thought should be, "Gosh, I'm glad I have an iPhone so they won't be able to unlock it until I open my eyes."

It is to the banks. Somebody steals your phone and unlocks Apple/Google pay. The way that works is exactly equivalent to somebody having typed in the card's pin, so thousands of dollars of fraudulent charges can be their responsibility.

Worse, in some countries, the burden of proof or presumption that those charges are unauthorized may be on you. So somebody stole your phone, flashed it by your face, and now you've lost many thousands of dollars.

 

[M3gatron]

The Apple m-series coprocessor does the exact same thing when you pick up the phone.

The U1 chip? No it doesn't do the same thing.
Also the Soli chip does something before you even touch the phone. That's what I was talking about.

 

[M3gatron]

The speed is irrelevant when FaceID is pretty much instant already. Also irrelevant because the iPhone doesn’t have a toggle to let you go straight to the home screen without swiping so you really can’t accurately compare speeds.

It's ultimately faster, I don't see how it's irrelevant when it's impossible to unlock the iphone as fast no matter what you do.

However, I can understand the desperate need of the Android user to grasp onto anything they can where they appear to have a “win”.

Honesty to me it starts to look like you are the one that needs a win.
OK fine, You win. I hope you will feel better now.