Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
You’d think a flaw like this would be found during initial R&D testing. Which leads me to believe, that they didn’t fully test this to slip by that’s a major security flaw. This is just _not_ a good year for Samsung, alongside the premature Galaxy fold.
 
  • Like
Reactions: I7guy
Can't wait for this thread to become yet another echo chamber full with people who prefer Touch ID to Face ID because having to put your finger in a certain place on the phone is somehow more convenient than having to do nothing.

Honest question, I have no FaceID phone, would it work for me the way I am used to use my iPhone for car audio?

What I do, many times per commute, is to blindly unlock and activate Siri with a “double click” of the home button, and then tell the phone to play this or that.

“Hey Siri” does not work for me, way too unreliable. Grabbing and looking at the phone is also no good, as that is both unsafe and a serious traffic offence in my country.

Do FaceID iPhones have a good way to handle this?
 
  • Like
Reactions: RHustler
The Bkav group with the mask are scammers. They refused to answer questions about how they did their test. Ars has a good article in them.

Forbes did a test using a 3D scanner to make a model of a users face to construct a mask, but it couldn’t fool the iPhone (they fooled several Android phones, though).

The videos with twins or family members are also scams.

Here’s how you perform the scam:

After initially training FaceID, you let the other person (or the mask) try to unlock. When it fails, enter your PIN. FaceID assumes it’s the same person since you entered your PIN. It then “merges” facial data from both people (or the person and the mask). Then you can unlock with both.


This is why NOBODY has ever posted a complete end-to-end video of this “hack” because they don’t want you to see how they do it. It’s also why they do this during the initial “learning” phase for FaceID (and previously TouchID) and not on a device a person has used for some time. This is because Apple states that your face (or fingerprint) is refined as you use it increasing security. The last part is important. How could security get better the more you use FaceID (TouchID)? Because the initial enrollment gets “most” of your biometric data while subsequent use allows the collection of additional data to refine their model of your face (finger).

In other words, an iPhone is least secure (easiest to fool) immediately after you enroll, and much harder to fool after you’ve used your device some a period of time.

I agree. But I’d phrase it more as when you enable Face ID. Have a second person that looks like you start using it and enter pin every time it fails. FaceID will slowly learn the second persons face and will work on both. It will not learn a second face if they look nothing alike.

I know my girlfriends pin on her XS and have entered it many times when faceid fails. But that’s just it. It always fails first as we don’t look alike.
 
Honest question, I have no FaceID phone, would it work for me the way I am used to use my iPhone for car audio?

What I do, many times per commute, is to blindly unlock and activate Siri with a “double click” of the home button, and then tell the phone to play this or that.

“Hey Siri” does not work for me, way too unreliable. Grabbing and looking at the phone is also no good, as that is both unsafe and a serious traffic offence in my country.

Do FaceID iPhones have a good way to handle this?
Set the auto lock timeout to never?
 
If you believe that iPhones overall catch less fire and explode less often, think again. Just ask any ER in the country. Also, isn't it MacBook Pros that are banned on airplanes because of massive battery issues?

Man, that’s whataboutism at its finest. Airlines have restrictive rules on lithium ion batteries. Not about MacBooks in particular. What able does have is more time from smaller batteries, because they make the stack. With Samsung, we‘re talking about one particular phone, where they crammed so much in one package that a large number of cases of Galaxies catching fire in the early weeks. you weren’t allowed to bring them on planes.
[automerge]1571330225[/automerge]
Set the auto lock timeout to never?
I use CarPlay, and once you attach the iPhone with the lightning cable, it can lock any time it wants, the lightning cable remains able to play music, etc.
 
  • Like
Reactions: Arndroid
Honest question, I have no FaceID phone, would it work for me the way I am used to use my iPhone for car audio?

What I do, many times per commute, is to blindly unlock and activate Siri with a “double click” of the home button, and then tell the phone to play this or that.

“Hey Siri” does not work for me, way too unreliable. Grabbing and looking at the phone is also no good, as that is both unsafe and a serious traffic offence in my country.

Do FaceID iPhones have a good way to handle this?
Android has a very simple and secure solution to this issue. One's phone can be set to be unlocked when connected to the car's Bluetooth system. This will permit full hands free operation of the phone. Or a passenger to use the phone.
 
I was just about to return the ten iPhone 11 Pro Max I bought and get S10s but this has me second guessing that decision.
 
Thing is: Now that we know a screen protector gel renders the scanner inoperable, someone will find an even more ubiquitous material that will do the same, like a bit of spittle, for instance. I would bet that the alternative for Samsung software is to lock the user out completely, when using the fingerprint sensor, and reverting to pin-only access.
 
Exactly my thoughts... I don’t have a PhD in electronic security measures or anything, so take my opinion with a grain of salt, but “I can’t make heads or tails of what I’m seeing, so let them in” doesn’t sound like it should be on the list of best practices...

My suspicion is that once we get the full story we'll find that this user enrolled their fingerprint with the screen protector on which resulting in "blank" minutia being stored as their fingerprint. At that point anyone else putting their finger on that screen protector would produce the same "blank" minutia and thus match and unlock. If that's true the fix will indeed just be software and will reject enrollment of any blank fingers (more likely will require a minimum number of points of fingerprint minutia rather than strictly "blank").

If I'm right this is embarrassing but not the end of the world by any means, and easily remedied.
[automerge]1571330640[/automerge]
My imperial evidence suggests that all motorcycle operators believe that rules of the road do not apply to them. Always speeding.

Are you royalty or did you receive your evidence from royalty? ;-)
 
Samsung should increase their testing. This, is an obvious test to do, just as with the fold, to test it in real live not sterile conditions.
 
hmm...didn’t Apple say they had replaced nearly 3M iPhone 6 batteries? Of course they are not called failures because Apple called it a support gesture for the benefit of their customers
Replacing worn-out batteries (something that happens to every battery eventually) is not quite the same as replacing defective batteries that have a tendency to go into thermal failure.

Yeah, Apple had a big PR problem to solve - aging batteries would trigger CPU throttling because they couldn't deliver the peak power required. They could have eliminated/tweaked the throttling feature (software patch, like Samsung is promising for this fingerprint issue) and returned to a situation where the phones would shut down/restart if the CPU needed too much power. OR, they could address the underlying problem - worn-out batteries. They dramatically reduced the price for replacing the battery and told staff to replace any battery at that price, on a wide range of models, regardless of whether the phone really needed a new battery. So yeah, 3 million batteries replaced.

You may disagree, but yes, that was a support gesture for the benefit of the customers that improved the performance of their aging phones (and extended their useful life by about two years) - it was not a safety recall.

Now, no company is immune from receiving defective batteries from a supplier. However, there are quality control steps a company can take to minimize the chances. Maybe Apple's QC practices are more stringent than Samsung's, or maybe Samsung has been unlucky. Both companies have had recalls due to defective batteries - Samsung, however, has had, by far, the biggest need-to-recall incident.
 
  • Like
Reactions: mech986
Replacing worn-out batteries (something that happens to every battery eventually) is not quite the same as replacing defective batteries that have a tendency to go into thermal failure.

...

Apple recalled those batteries in the spring, less than 6 months new.
 
So wouldn't taking off the screen protector fix this?
I could just have my own and lay it on your phone and unlock it. It’s unlikely that a screensaver needs to be fully installed to work.
[automerge]1571331720[/automerge]
Lol... Because Apple's Face ID was not a fiasco also. Days when iPhone were not a glitch show are long gone. And people still pqy 1K for them

Do not get a screen protector till the patch or use a different unlock option.
Not using a screen saver just keeps it from opening for anyone. But anyone could still unlock it if they wanted to do so.
[automerge]1571331862[/automerge]
For the record, my persistence disdain with FaceID is that I do motorcycle touring to the tune of 12K+ miles a year and had to go back to a 4-digit passcode because while my gloves work with TouchID & the touch screen, my helmet does not work with FaceID so when I need to do anything I used to be able to unlock but now I have to stop and remove my helmet or type in a passcode. this has been going on with me for 3 years and I hate it every time.
That’s an extreme edge case. In normal usage Face ID is streets ahead of Touch ID.
 
For the record, my persistence disdain with FaceID is that I do motorcycle touring to the tune of 12K+ miles a year and had to go back to a 4-digit passcode because while my gloves work with TouchID & the touch screen, my helmet does not work with FaceID so when I need to do anything I used to be able to unlock but now I have to stop and remove my helmet or type in a passcode. this has been going on with me for 3 years and I hate it every time.
That’s an extreme edge case. In normal usage Face ID is streets ahead of Touch ID.

My work phone is a Galaxy S10e (paid for by my employer) and it is a very good phone. That being said, the security issues with using Android and Google services are very real. As long as you understand that you are sacrificing massive amounts of privacy and that your device is less secure, then they make good phones.
The problem is a lot of people carry around a ton of personal information and access to very sensitive accounts and services on their phone. Being insecure makes it fairly unusable for a lot of people.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.