Google Pixel 4's Face Unlock Feature Works With Eyes Closed, Sparking Security Concerns

[jsw]

I use an 11 Max Pro as my daily driver, and I had the XS Max before, and many other iPhones before that. I used to moderate this forum, so... I'm pretty pro-Apple. I also have owned most Google phones back to the Nexus 4, and a few other Android phones. I currently also use a Pixel 3. Here's where I stand on this mess:

Google screwed up. They'll fix it with the leaked switch to enable eye contact. It'll then be as secure as Face ID, if not more so because of Soli. People are all worked up over something on a phone which hasn't even started shipping yet. It'll be fixed before anyone gets one.

Now for a rant:

I hate Face ID. I freaking hate it. I have the best Apple phone out there, and I can't open Audible while I'm driving because I need to unlock the phone by looking at it. The one big advantage the Pixel 3 has is that I can unlock it without looking at it. On-the-back fingerprint ID is the best. The Pixel is always ready when I look at it, and I usually do not even need to do that to use a lot of things (like Audible). Even when I'm just sitting around, I need to slide the iPhone's screen up. Sure, it unlocks fast, but damn it, I don't want to also have to slide it up.

And now Google has gone the same way. I've not yet gotten the P4, and it seems at least the screen will be ready for input when it recognizes me, but... still. I prefer the fingerprint scanner. Much easier. No unexpected unlocks. Super easy to use.

I don't know why neither of them deigns to include a $1 (maybe?) scanner in addition to the face unlock. Actually, Apple can't because they'd need to put it on the back and that would be too "Android". But Google could have. They could have spend some of the build budget they saved by leaving out a 3rd lens, which would have easily fit in the giant square they just had to have to look like an iPhone.

Both Google and Apple annoy the crap out of me with just not doing simple things. Apple should give me a way to unlock my phone without staring at it. Let me disable it, fine, but give it to me. Same too, now, for Google. And Google.... if they decide to price things like they were iPhones, freaking build them like iPhones. A Pixel 4 XL for $600 would be incredible. At $900 - $1000? Not so much. I might even skip it altogether. Both companies should make 128GB a minimum. Period.

But... all y'all fighting over which phone is best need to quiet down. Both OSs are now way more alike than they are different - I'm saying this as someone who uses both each day. Both phones can do some seriously cool things. Each has some advantages and some negatives, but overall both will work about the same. Google will maybe someday figure out how to do video (God, Pixel video sucks), and Apple will maybe someday have a usable alternative to Night Sight (the Pixel 3 beats the 11 Max Pro in dark scenes; the Pixel 4 will probably destroy it). But in general both are interchangeable.

 

[Khedron]

Wow what nonsense. How many stories have there been on the news that someone's phone was stolen unlocked and then the thief went on an Apple Pay buying spree. Even if the phone is unlocked, re-authentication is required prior to using Apple Pay.

That's what I imagined, and why I said to begin unlocking a phone while someone is asleep does nothing to help you then go buy things with it, so the awareness requirement is irrelevant.

 

[konqerror]

That's what I imagined, and why I said to begin unlocking a phone while someone is asleep does nothing to help you then go buy things with it, so the awareness requirement is irrelevant.

It's not irrelevant. I suspect the core issue is that Apple or somebody else owns patents on facial ID attention awareness. So your precious Google can't have it. That's why it was implemented in beta then pulled. Not because it was a bad or unnecessary idea.

If Google didn't think it was a good idea, they wouldn't have bothered to implement it in beta. So it boils down to either their implementation was found to be faulty, or it infringed on somebody's IP rights.

 

[TopherMan12]

I hate Face ID. I freaking hate it. I have the best Apple phone out there, and I can't open Audible while I'm driving because I need to unlock the phone by looking at it. The one big advantage the Pixel 3 has is that I can unlock it without looking at it. On-the-back fingerprint ID is the best. The Pixel is always ready when I look at it, and I usually do not even need to do that to use a lot of things (like Audible). Even when I'm just sitting around, I need to slide the iPhone's screen up. Sure, it unlocks fast, but damn it, I don't want to also have to slide it up.

Then disable Face ID. Simple. Use Passcodes. But frankly, you shouldn't be engaging any app while you are driving. You are a hazard when you do this. Start your Audible app before driving listen while you drive. Why is this hard?

Both Google and Apple annoy the crap out of me with just not doing simple things. Apple should give me a way to unlock my phone without staring at it. Let me disable it, fine, but give it to me.

They do.

But... all y'all fighting over which phone is best need to quiet down.

Suddenly you are complaining about others doing what you just did?

 

[Abazigal]

Uh no. You've obviously never used Apple Pay or Google Pay. Somebody pickpockets your phone in a store. They flash it by your face and it unlocks. They then go to a complicit worker and buy easily resellable goods like phones and TVs.

I am curious as to how often this successfully works.

First, the thief has to pick my iphone, then flash it at my face (and assume I will just stand there doing nothing while allowing my phone to unlock, and assuming face attention isn't preventing this from working), then successfully get away from me and the authorities, before handing the phone over to someone else who then uses my phone to buy something. Which requires that the iPhone be unlocked through this entire time, and trying to activate Apple Pay requires that you authenticate with my face again.

During this time, I can easily lock my iPhone via find my iphone, or call my bank to have my credit card cancelled, or both.

It already sounds ridiculous to me on paper, and I really can't see this working in real life.

 

[jsw]

Then disable Face ID. Simple. Use Passcodes. But frankly, you shouldn't be engaging any app while you are driving. You are a hazard when you do this. Start your Audible app before driving listen while you drive. Why is this hard?

It's not hard. On the Pixel, I ask Google to start it. It asks me to unlock the phone. I touch it. I never look at it. How is this a hazard? Answer: it isn't. I have zero problems engaging numerous apps by voice on the Pixel. On the iPhone, anything requiring an unlock is off limits. A passcode doesn't really help with the issue of not having to look at the phone now, does it?

They do.

No, they don't. I said a way to unlock my phone without looking at it. Perhaps I should have been more specific and said "without holding it in front of my face while driving or in a meeting or in any of a number of situations where holding it near my face is inconvenient but where I don't want people to watch me enter my PIN."

Suddenly you are complaining about others doing what you just did?

I'm complaining about the one-sidedness of it. Both have pluses. Both have negatives. It's foolish to sit around and act like whichever one you have is the clearly superior product. It isn't.

 

[matrix07]

It's not hard. On the Pixel, I ask Google to start it. It asks me to unlock the phone. I touch it. I never look at it. How is this a hazard? Answer: it isn't. I have zero problems engaging numerous apps by voice on the Pixel. On the iPhone, anything requiring an unlock is off limits. A passcode doesn't really help with the issue of not having to look at the phone now, does it?

Isn’t it illegal using phone while driving?

 

[konqerror]

I am curious as to how often this successfully works.

First, the thief has to pick my iphone, then flash it at my face (and assume I will just stand there doing nothing while allowing my phone to unlock, and assuming face attention isn't preventing this from working), then successfully get away from me and the authorities, before handing the phone over to someone else who then uses my phone to buy something. Which requires that the iPhone be unlocked through this entire time, and trying to activate Apple Pay requires that you authenticate with my face again.

During this time, I can easily lock my iPhone via find my iphone, or call my bank to have my credit card cancelled, or both.

It already sounds ridiculous to me on paper, and I really can't see this working in real life.

It seems apparent that very few people here have used Apple and Google Pay.

Grab the phone. Double click the side button and expose to face. Easy without attention awareness, like Google is doing. Payments are now unlocked for 30 seconds. Any transaction during this time will be authorized.

You can take the phone to a terminal, i.e. you pickpocketed somebody in the store. Or you can use a mobile terminal, like they use in restaurants or the Apple Store or Square.

Or you can tunnel the EMV data over the Internet: this has been demonstrated over thousands of miles. Somebody stands at a terminal with a special phone and the NFC data is sent between another phone and the card/stolen device. This is because there's no way of checking locality in contact or contactless EMV. All you need are two NFC-equipped phones and Internet access.

 

[Peepo]

If I have attention shutoff for Face ID I can unlock my iPhone X with my eyes close too.

 

[jona2125]

This is a very easy experiment to replicate so I suggest you try it. I have. I have never been able to make it work. Don't get me wrong, I am not saying it won't work. I am just saying it is not as easy as implied and is NOWHERE near the same as the Pixel 4 issue.

I have tried it. That’s my job.

Also I never said it was the same issue as the pixel I was replying to a comment

 

[matrix07]

I have tried it. That’s my job.

Also I never said it was the same issue as the pixel I was replying to a comment

Like he said, it is very easy to try and I tried it and it didn’t work. 🤷🏻‍♂️

 

[I7guy]

That's what I imagined, and why I said to begin unlocking a phone while someone is asleep does nothing to help you then go buy things with it, so the awareness requirement is irrelevant.

First off, you can't unlock an iphone if "require attention for face id" is enabled and the eyes are closed. Secondly why bother, just threaten the use of force and then it's irrelevant what phone or biometric you have. Or if you have a Samsung s10, just hold any fingerprint to unlock it.

 

[TopherMan12]

It's not hard. On the Pixel, I ask Google to start it. It asks me to unlock the phone. I touch it. I never look at it. How is this a hazard? Answer: it isn't. I have zero problems engaging numerous apps by voice on the Pixel. On the iPhone, anything requiring an unlock is off limits. A passcode doesn't really help with the issue of not having to look at the phone now, does it?

Oh....so now you are talking about voice commands? Your point was about Face ID and how you are required to unlock your phone by "looking at it". Pretty sure you have to look at your phone to pick it up and somehow find the fingerprint position. With FaceID, you don't have to touch your phone. And yes, you are a hazard with your distracted driving. Again....start your Audible book first before you start driving. It isn't hard on any device that way and you do not endanger others.

As far as voice commands......I'm not so sure I like the idea of anyone being able to operate my device via voice commands when it is locked.

No, they don't.

Yes, they absolutely allow you to disable Face ID.

I'm complaining about the one-sidedness of it. Both have pluses. Both have negatives. It's foolish to sit around and act like whichever one you have is the clearly superior product. It isn't.

It is blatantly obvious that there is more than one side in this discussion.

 

[I7guy]

It seems apparent that very few people here have used Apple and Google Pay.

Grab the phone. Double click the side button and expose to face. Easy without attention awareness, like Google is doing. Payments are now unlocked for 30 seconds. Any transaction during this time will be authorized.

You can take the phone to a terminal, i.e. you pickpocketed somebody in the store. Or you can use a mobile terminal, like they use in restaurants or the Apple Store or Square.

Or you can tunnel the EMV data over the Internet: this has been demonstrated over thousands of miles. Somebody stands at a terminal with a special phone and the NFC data is sent between another phone and the card/stolen device. This is because there's no way of checking locality in contact or contactless EMV. All you need are two NFC-equipped phones and Internet access.

I don’t know what Apple Pay merchant identification does. But if you pickpocket my unlocked phone, you still need to authenticate with face id prior to using Apple Pay. If you have "require attention" turned on, it's more difficult or even impossible for someone else to authenticate with the owners face.

 

[konqerror]

I don’t know what Apple Pay merchant identification does.

It uploads your coordinates when Apple Pay is used, to be correlated with store POIs on Maps. Once Apple gets a sufficient number of pings, the store will have an Apple Pay logo in Maps.

If you have "require attention" turned on, it's more difficult or even impossible for someone else to authenticate with the owners face.

Hence the whole discussion why thousands of dollars are potentially at stake in Google's crappy implementation of face recognition.

 

[dazed]

I got an iPhone 8 over an X because I didnt want Face ID. When I finally have to upgrade I may just disable it and go back to a passcode. It’s not difficult to tap in a few numbers.

 

[matrix07]

I got an iPhone 8 over an X because I didnt want Face ID. When I finally have to upgrade I may just disable it and go back to a passcode. It’s not difficult to tap in a few numbers.

FaceID is superior to TouchID almost every Way.

 

[realtuner]

edit: Ah....nevermind. You are correct.

https://support.apple.com/en-us/HT208076

"If you use the Emergency SOS shortcut, you need to enter your passcode to re-enable Touch ID, even if you don't complete a call to emergency services. "

There's a better way. Simply say: "Hey Siri, whose phone is this?" Has the same effect as pressing the button 5 times, however, you don't have to grab your phone to do it.

Note: I just tried it on my iPhone, and if you looked at your iPhone (and FaceID unlocked your notification screen) then it doesn't work. You have to say it to your iPhone when it's locked and without looking at the screen (to avoid activating FaceID).

Uh no. You've obviously never used Apple Pay or Google Pay. Somebody pickpockets your phone in a store. They flash it by your face and it unlocks. They then go to a complicit worker and buy easily resellable goods like phones and TVs.

Considering Apple Pay has a limit with banks (usually $100) I'm not sure it's worth the trouble for any thief (even a desperate one) to risk stealing someone's phone just to buy an under $100 item that they'll have to resell for even less.

 

[Arndroid]

Its was quite painful to read the few comments of this thread. Its obvious most users here aren't very well informed.

There's too much drama about this situation when there was already a leaked image that shows an option that says, eyes need to be opened for face authentication to work on the Pixel 4. Most likely Google will introduce the option with the first or second update they push to the Pixel 4.

From the hands on I've seen Google's Face Authentication is very fast(faster than FaceID at first glance) and form a security stand point, it can be used with mobile payments and bank apps so I don't see a problem there.

View attachment 870508

The problem is someone can drain your bank account with just you sleeping next to your phone.

 

[Arndroid]

At the end of the day, a PIN is the most secure way to unlock your phone, as long as you don't use 1234 or your birthday. Just about all phones have this ability. But nope, companies like Apple and Samsung won't settle for just a PIN. It's not sexy enough, and not good marketing material. This is not just coming from me - I have a friend who is a coder, and took digital security classes - this is what he was taught.

I believe that my under-display fingerprint scanner in my S10 is actually pretty secure - it requires a rather precise position to work properly, so I don't think someone would be able to easily put my finger on it if, say, I was asleep. And no one could hold the phone up to my face to unlock it, as I don't have facial recognition enabled.

Yeah unfortunately they don’t need your finger at all to unlock it. Your s10 is currently the least secure phone on the market.
[automerge]1571462315[/automerge]

Largest over hype I have ever seen.. this is not a big deal at ALL. I couldn't care less if I have to look at it, I turn that off on Apple devices as is... Such click bait.

Lol real security is click bait

 

[Arndroid]

It's ultimately faster, I don't see how it's irrelevant when it's impossible to unlock the iphone as fast no matter what you do.



Honesty to me it starts to look like you are the one that needs a win.
OK fine, You win. I hope you will feel better now.

Wow it is faster at being less secure.

 

[konqerror]

Considering Apple Pay has a limit with banks (usually $100) I'm not sure it's worth the trouble for any thief (even a desperate one) to risk stealing someone's phone just to buy an under $100 item that they'll have to resell for even less.

It does not have such a limit, at least in the United States. The idea is the biometrics are more secure than a static PIN, or no verification at all, which is the current situation with physical cards in the US.

(Note Apple Pay/mobile wallets do not necessarily share the same limits as contactless cards. That's the point of CDCVM, it proves to the terminal that the transaction was authorized via PIN or biometrics)

 

[teodoro]

what could possibly go wrong, if eyes closed works there are most likely other security concerns.

A lot,

 

[Black Belt]

Cops can open your phone after they shoot you

 

[Tech198]

lol.. opps.

Someone forgot to test..

the wierd and wonderful things people do to try the non-correct way of unlocking devices. I guess most things are uncovered by accidents.

I don't think bringing out a support document on this hinting "this is by design" is gonna change anything