iPhone X Face ID Again Unlocked With Mask, Even With 'Require Attention' Turned On

[DeepIn2U]

yeah, you’re right...iPhone 8+ has TouchID that can be bypassed with PLAYDOH in MINUTES vs. this FaceID “hack”...and iPhone 8 with the inferior camera, inferior display that cannot display HDR/DV to the fullest, and 3 year old design. You’re right dude...YOU SHOULD BE HAPPY.

Well since the phone is using iOS, great browser, a plethora of great apps that can suit quite a few million people’s needs, not unlike Android, I think if a person has chosen a phone of their choice that suits their price threshold and their needs then yeah why can’t he/she be happy?!

You said you haven’t posted in a while on these forums due to haters and comments by others that don’t own the device a particular thread is the focus of topic on. Yet a person such as myself can easily realize in 2 of your posts in this same thread can see you’re just part of the issue you claim to avoid here: you’re hating on someone else’s choice that their enjoying that suits their comfort level.

Way to go on your return, you’ve been sorely missed by many of us. Truthfully I’ve also fallen to this many times before yet slowly adjusting. I hope you do as well.

So has Apple straight-out lied during the keynote? They said Face ID was more secure than Touch ID. There’s now numerous evidence to the contrary.

I think having the owner of the X available, known passcode, along with the mask is circumventing what the A11 neural net algorithm is meant for. It’s probably learning the mask along with the owners face as a single person.

 

[rob.james.arias]

Not a real issue, my phone is so secure and amazing it doesn't recognize my face half of the time. Good luck using a mask.

 

[acctman]

X owner here. Am I worried? No.

i'm not worried but I do feel like Apple lied to its users with the 1:1m ... they also claimed to have had hollywood mask/make up artist designing mask in order to fool the system and it didn't work. This all seems like a lie now, for a phone that is $1000-1200 regardless if the feature is used it should work to what its claimed. If Apple never mentioned the 1:1mil or the Hollywood make-up artist then is wouldn't be a big deal. But clearly its flawed

 

[Cloudkicker]

It'd be good if you kidnapped someone & used their face to make a mask, use their phone to pose as them to dig for more info, then ultimately ask for a big ransom payday. Then Steve Jobs ghost would just tell me you're masking wrong, or your ransoming wrong. Then I'd let the person go w/ caveat: "We're cool, right?"

 

[Ramchi]

More realistic use case would be unlock with Face ID for few days then suddenly apply this method of using the mask to unlock, and see the results. Typically, it is almost next to impossibility that iPhone X gets stolen immediately after the Face ID setup and after one or two attempts to unlock the mobile.

 

[Michael Scrip]

i'm not worried but I do feel like Apple lied to its users with the 1:1m ... they also claimed to have had hollywood mask/make up artist designing mask in order to fool the system and it didn't work. This all seems like a lie now, for a phone that is $1000-1200 regardless if the feature is used it should work to what its claimed. If Apple never mentioned the 1:1mil or the Hollywood make-up artist then is wouldn't be a big deal. But clearly its flawed

I'd love to know how much time the Hollywood mask artists spent with Apple working on FaceID... and what their actual tests/results were. Since FaceID is a pretty important security feature... you'd hope Apple wouldn't half-ass it.

And yet this security firm was (allegedly) able to spoof it with masks in a few weeks.

Either Apple found the absolute worst Hollywood makeup artists... or we simply misunderstood what Apple said in the keynote.

I'm not worried about it though. When I get an iPhone X... I'll certainly use FaceID just like I use TouchID now.

The problem with this video and the older TouchID spoof videos is that the owner of the phone is involved. He's standing right there. He knows the passcode. And they have unlimited time and unlimited retries. It's not a real-world scenario. It's a lab experiment.

It would be exponentially more difficult if they stole an iPhone off the street and try to spoof FaceID/TouchID with the clock ticking for Activation Lock...

 

[kdarling]

i'm not worried but I do feel like Apple lied to its users with the 1:1m ... they also claimed to have had hollywood mask/make up artist designing mask in order to fool the system and it didn't work. This all seems like a lie now, for a phone that is $1000-1200 regardless if the feature is used it should work to what its claimed. If Apple never mentioned the 1:1mil or the Hollywood make-up artist then is wouldn't be a big deal. But clearly its flawed

The one in a million is the chance of a random stranger matching your face enough to unlock your phone. Apple did not claim it applied to masks or family. That's something you assumed. In fact, they specifically state that twins or young kids can match.

Also, Apple only said that they used Hollywood mask makers to help test it with spoofs, not that such testing actually made it totally safe from such spoofs.

The way Apple says something, versus what you thought they said, are often two totally different things.

Anyone who is worried by this is already someone who doesn’t/shouldn’t use Touch ID either. For everyone else this is a non issue

Exactly. No biometric method is totally secure. But they're good enough for the majority of situations a common person will face (no pun intended).

 

[gijoeinla]

i'm not worried but I do feel like Apple lied to its users with the 1:1m ... they also claimed to have had hollywood mask/make up artist designing mask in order to fool the system and it didn't work. This all seems like a lie now, for a phone that is $1000-1200 regardless if the feature is used it should work to what its claimed. If Apple never mentioned the 1:1mil or the Hollywood make-up artist then is wouldn't be a big deal. But clearly its flawed

What the hell?

Do you yourself have a X? Do you? I’ve had mine 7 days. In the last 2-3 days sometimes FaceID doesn’t unlock and it REQUIRES my password to allow FaceID to work.

Do I need to repeat myself?

Do you even know what your talking about?

It’s called 2-step authentication, Doh! Touch ID did the very same thing.

How bout that!

 

[BigDO]

This bunch is so desperate for clicks and attention, and they come across as sleazy amateurs in the process rather than security specialists. Just lol at that "mask".
[doublepost=1511853608][/doublepost]

What this article fails to take into account is that all you need is two or three photographs from slightly different angles to be able to produce a high quality 3D image than can be printed.

3D printers are becoming quite cheap and the materials are constantly dropping in price.

We already know that criminals that wish to steal phones work in pairs in many countries, one could be taking photographs of the person while the other is pick pocketing them.

This also means that the government now has a super easy way to unlock any phone with facial recognition within hours of an arrest. They take mugshots from multiple angles, so making a 3D mask would be trivial and given the money they have, they could quite easily have equipment that could produce them in under an hour. And your likeness would most likely not be protected by law, which means no warrant would be necessary.

So, yes, the average consumer should indeed be very worried about this, in this case it was a proof of concept, which means the process can be refined, sped up and made substantially cheaper. In the end, I think they are right that fingerprint sensors are indeed much more secure, not perfect, but more secure than face ID.

That's all true, but a moot point in this context. ANY biometric authentication can be easily spoofed once you have physical access to the subject. Even the TouchID can be spoofed in the way you mention, as fingerprinting is routinely done when booking perps in.

 

[Larabee119]

BKAV is famous for faking and over-stating (in other words: they lie about almost everything), so I'm not going to believe this.

 

[BugeyeSTI]

i'm not worried but I do feel like Apple lied to its users with the 1:1m ... they also claimed to have had hollywood mask/make up artist designing mask in order to fool the system and it didn't work. This all seems like a lie now, for a phone that is $1000-1200 regardless if the feature is used it should work to what its claimed. If Apple never mentioned the 1:1mil or the Hollywood make-up artist then is wouldn't be a big deal. But clearly its flawed

There’s a one and a million chance you could get me to let someone laser map my face or take the amount of photos necessary to create a mask good enough to fool faceid so I think Apple was accurate in the odds. The $200 the mask cost is really a moot point considering getting the necessary data to create the mask is impossible without the willingness of the phone owner to allow it.

 

[Tijdelijk]

i'm not worried but I do feel like Apple lied to its users with the 1:1m ... they also claimed to have had hollywood mask/make up artist designing mask in order to fool the system and it didn't work. This all seems like a lie now, for a phone that is $1000-1200 regardless if the feature is used it should work to what its claimed. If Apple never mentioned the 1:1mil or the Hollywood make-up artist then is wouldn't be a big deal. But clearly its flawed

NO Apple did not lie about 1:1M

What they meant is that if you find an iPhone X the chance is 1:1M you can unlock the iPhone!

This test is totally different. They know the face!!

 

[gijoeinla]

NO Apple did not lie about 1:1M

What they meant is that if you find an iPhone X the chance is 1:1M you can unlock the iPhone!

This test is totally different. They know the face!!

Hahaha true. Simply put.

Btw. In order for me to “authenticate” my macrumors user ID and password is allow FaceID to REAUTHENTICATE ME - which I might add happens multiple times in accessing apps of all kinds. Something Touch ID did not do as routinely.

Bottom line - you’ll need to keep pulling out The Mask over and over to gain access to your bank, or MacRumors.

 

[waquzy]

PS: This project was funded by Samsung.

 

[Ennox]

It appears as if the "trick" only works with a certain distance and angle to the face. He could have just held the X in front of the mask, however, he positions it carefully, then tilts the iphone slighty. See the white stripe on the metal, which might be a position marker.

 

[Klyster]

So many news about this intricate attempt to fool FaceID, yet I didn't see as much scrutiny when a guy fooled Samsung's Face unlock with just a printed face on paper.

Note that TouchID can also be fooled (easier) by making a silicone copy of your fingerprint (demonstrated multiple times already), the same with many fingerprint sensors. So I would think FaceID is more "secure," as it takes quite a bit more effort.

That's because it was BS....

 

[User 6502]

Did you even watch the video? He didn’t use the passcode at all with the mask, after the initial setup with his real face (and we know it was the initial setup because we could see him doing it)he never again used the code.

Without having to unlock with the passcode? I very much doubt it. It's simple.

Train the phone with your face. Try to unlock with the mask. It fails. That's where you are stuck without the help of the phone owner. Now the phone owner unlocks the phone. So the camera thinks the mask must have been the legitimate image. The camera adapts. If need, you repeat, until the phone recognises the mask easily.

You can do that, as the legitimate owner of the phone, and as someone who has the passcode. Doesn't work if you don't have the passcode. And if you have the passcode, then you can unlock the phone thousand times easier and quicker. By entering the passcode.

 

[zoomcrypt]

and in the next IOS update the algorithm will have been updated and this will no longer work. w00t.

Since the iPhone X launched earlier this month, people have been attempting to fool Face ID, the new biometric facial recognition feature built into the device as a primary security feature. Face ID has thus far been tricked by twins, children, and even a mask.

Vietnamese security company Bkav made headlines in mid-November after uploading a video featuring Face ID accessed by a mask, but there were several questions about the unlocking methods used in the video, including whether "Require Attention" was turned on. Today, Bkav shared a second video with a new mask and a clearer look at how the mask was used to spoof Face ID.

As described in an accompanying blog post, Bkav used a 3D printed mask made of stone powder, which cost approximately $200 to produce. 2D infrared images of eyes were then taped over the mask to emulate real eyes.

Bkav reset Face ID on camera and then set it up anew with the demonstrator's face. "Require Attention for Face ID" and "Attention Aware Features" were both shown to be enabled on the iPhone X. For those unaware, "Require Attention for Face ID" is meant to add an extra layer of security by requiring you to look at your iPhone to use Face ID, and it's one of the features that's supposed to prevent Face ID from unlocking with a mask, with a photograph, or when you're looking away from your phone.

After activating Face ID, the Bkav demonstrator unlocks the iPhone X normally with his own face, and then unlocks it once again with the mask. The mask appears to be able to unlock the iPhone X right away, with no failed attempts and no learning, as Face ID was set up from scratch just before the test. The mask's 2D infrared eyes also appear to fool the "Require Attention for Face ID" setting.

Bkav claims the materials and tools used to create the mask are "casual for anyone" and that Face ID is "not secure enough to be used in business transactions," but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face. Even then, if the 3D printed mask and the design of the infrared eyes aren't perfect, Face ID will fail after five attempts.

Bkav believes Face ID is less secure than Touch ID because it's easier to capture photographs from afar than it is to obtain a fingerprint, but this is still a very complex replication process that the average user does not need to be concerned with.
Apple's Face ID security white paper [PDF] outlines several scenarios where Face ID has a higher probability of being fooled, including with twins, siblings that look alike, and children under the age of 13, but masks are of particular interest because Face ID features a neural network that was "trained to spot and resist spoofing" to protect against "attempts to unlock your phone with photos or masks." From Apple:When Touch ID, Face ID's predecessor, was first released in the iPhone 5s in 2013, there were many similar demonstrations of how it could be fooled with a fake fingerprint, but there's little evidence that these methods were ever used to unlock devices in the real world on a wide scale basis, and it turned out to be something most iPhone users did not need to worry about. The same is likely true of Face ID.

Apple has made several improvements to Touch ID over the years, making it faster and more accurate, and similar improvements will undoubtedly be made to Face ID in the future. In the meantime, while Face ID can be fooled by a twin or a complicated facial replication process, it's largely secure for most users and has received mostly positive reviews for its security and ease of use.

Article Link: iPhone X Face ID Again Unlocked With Mask, Even With 'Require Attention' Turned On

 

[one more]

Technically, Touch ID can also be easily fooled by somebody just pressing your real finger on the Home button, no investment or 3D printing required. If one needs a higher security, it is probably better to stick to security codes.

 

[batchtaster]

When you reset Face ID, you also delete all the training.
They're touting it as "look how little effort," yet it's the most effort of all, since this scenario is exactly the time when the phone is at its most vulnerable, and also the least likely state.
Do this with a random stranger's phone while it's already set up, then we'll talk. I'll even stipulate that you can take comprehensive photos of the stranger. But, you don't get to assume access to the phone to set up your demo. Do it cold or GTFO.

 

[Wowereit]

I will bet you that you cannot, no matter how good your mask is, unlock my iPhone. (I have an 8 Plus)

Yeah, I just need some silicone, 2 wires and a 20 cent battery.

Who ever thinks that creating those masks is easier than faking a finger print with stuff from an DIY store is mistaken.

 

[Piggie]

It does.

How many million people did Apple test Face ID with.
Or is this Million figure a estimate based upon some statistics?

Funny isn't it.

Think about it for one moment.
What are the chances, you come up with Face ID test it, and WOW, amazingly it's accuracy is exactly 1 in 1 million.

Not 900,000 or 1,000,500 but exactly 1 million. How neat and tidy is that?
It's almost as if this number was used for neat advertising reasons

 

[testcard]

If some criminal mastermind wants to make a 3D death mask of my face, and then steal and unlock my X, they’re welcome to it.

 

[lwells1441]

Even if Face ID is able to be unlocked with a mask of Jabba the Hutt and Chewbacca, I’m still not downgrading back to the ugly and outdated iPhone 8

Hell no

Outdated? ... maybe. Ugly? No way.

 

[Ennox]

While setting up Face ID, the guy appears to try to avoid getting his chin scanned correctly.