Slashdot Mirror
Samsung Galaxy S3 Face Unlock Tricked By Photograph
AlistairCharlton writes with a story about an Android Face unlock security system that could use some tweaking. "Android's Face Unlock security on the Samsung Galaxy S3 can be tricked into unlocking the phone by showing it a photograph of the owner. In a test carried out by IBTimes UK, we found that the Galaxy S3 cannot distinguish between a photograph and a real person, leading us to suggest users should select a more secure way of locking the phone, such as with a PIN or password."
This is my shocked face...
Face unlock is not intended to be industrial grade security. By its nature it has to be tolerant to unlocks (it would suck if you couldn't unlock your phone after a haircut or beard trim, for example). It's intended to prevent casual perusal by someone who finds the phone sitting around. They've added some little things like requiring some movement in the face (eg, blinking), so it's mildly surprising that a static photo can trick it. But it's not especially worrying either - again, it's meant to be one step above slide to unlock.
It's almost like stating that the standard "slide to unlock" is insecure because anyone can slide that button! The statement is true, but it misses the point.
Also, a quote from Samsung taken directly FTFA:
Slay a dragon... over lunch!
...duh? really?
help me i've cloned myself and can't remember which one I am
This is a "feature", not a "bug". In fact, it's a "safety feature".
Now there is no need for someone to kill you, skin your face off, and make a mask out of it to break into your phone (like in the movies). They can just take a photo of you from a telephoto lens. Sign me up!
One concern is if the owner is really hideous looking. There is the risk that it could shatter the camera lens and then the phone would NEVER unlock!
It would be even more dangerous if someone compiled a whole book of face photographs... i dunno, maybe they could call it a "face book" or something like this.
I agree that nobody should rely on this for security, but I think it would be more secure if it was a 3D camera instead of a 2D one. Then it could work more similarly to Kinect. But I suppose then that someone could take a picture of a person on their Nintendo 3DS and trick the phone that way. :)
I'm safe. My face cracks lenses.
Place nail here >+
The same thing is possible on the Galaxy Nexus as was found out 8 months ago.
Face unlock was never intended to be biometric level security.
They could have the user do something like shake their head to prove that it's a 3D shape. And then somebody could write a tablet app that takes a flat photo and wraps it around a 3D, animatable head model. This could pretty much be a never-ending war of escalating sophistication.
As long as people know it's basically a toy and a way to keep honest people out, it will be OK.
Unless they manage to squeeze in a high-resolution thermal imager too, to verify that the face is indeed living (and maybe map out the veins, but that would require a rather sensitive imager), no face-unlock will be 100% secure. Bit higher on the scale than a slider or a pattern unlock, but waaaay lower than a PIN/password lock.
Hyperbole: I use it liberally!
That said, this isn't meant to be industrial grade security. Compared to no security at all, this is a big step up. The likelihood that I loose my phone in the parking lot and someone who finds it has a picture of me to unlock the phone with seems extremely slim. More likely, this would be vulnerable to attack from people I know, but even then, it's better than nothing.
Use someone *else's* face as your unlock.
Like Teddy Roosevelt.
And then put that picture as your login screen, so it'll log you in if you point at a mirror.
It'll still be a problem if Zombie Teddy Roosevelt steals your phone, but how likely is that...
You can put your weed in there!
Face recognition recognises faces.
On Mythbusters when checking out different security devices they found that you can fool a fingerprint scanner with a paper copy of the fingerprint.
http://en.wikipedia.org/wiki/MythBusters_(2006_season)#Fingerprint_Lock
Don't know something? Look it up. Still don't know? Then ask.
Equip the phone with two or more cameras so that the user's face can be verified in 3D, thus making it a lot harder to fool the system with one or more 2D pictures.
It can also be bypassed by anyone with a computer, and so can those other "security methods." Actually, calling them "security" is a bit of a misnomer - it's more like a temporary privacy screen. Next you'll be telling me my laptop is insecure because someone could chop off my finger and use it to log in to Windows with my fingerprint scanner - yeah, or they could use any one of a thousand boot discs that bypass the Windows log-on process entirely. The face scanner, like the finger printer scanner (when set up for Windows log-in, not as part of a PKI or similar) is just an ease-of-use thing designed to keep your co-workers from picking up your phone or laptop and seeing all that Lego porn you've got on there.
How do you think they QA'd it. with real people! Ha HA hA!
CAPTCHA = acetone
That... uh... so you're tricking the phone into thinking it's seeing you by showing you a picture of yourself which I assume looks like you?... it's not exactly supposed to be doing a retina scan.
In the land of the blind, the one-eyed man is kinky.
..you can do this to all laptops using the same trick
probably because the photo becomes so general that after awhile it has a very high tolerance
but as said, this is old news
Since most pin/swipe patterns are limited in security why not combine face unlock with a pin. Add a little security without much hassle for user.
There's an easy solution! Just cross your eyes and stick out your tongue when taking the security image! Of course, the people on the bus might think you're a little looney each time you unlock your phone, but that's the price you pay for security!
------RM
As seen on Youtube.
and not just Samsung Galaxy S3, but any phone with Android 4.0 (ICS) with face unlock active. My EVO 4g LTE can be fooled the same way, but what is the odds that some random person just happens to have a picture of me? It's more likely they could guess my pin/pattern.
if (it != oneThing) it = another;
No information on the test they performed whatsoever, no shots of the photos used, no information on how they overcame (or if they did at all) the supposed blinking requirement. This news site has a low opinion of their readers to not even include the simplest information.
Still more secure than PINs of 1234, 0000, etc and passwords of (well) "password", "god", "joshua", etc
Last I checked on my Samsung Galaxy SII (with ICS 4.0.3), the "Face Unlock" feature was aptly labeled as "Low Security, Experimental".
The only item marked as "High Security" is the password option.
I don't have an S3, but from what I've read the UI/OS version is pretty close at the moment (4.0.3 vs. 4.0.4). And I do believe, correct me if I'm wrong, that "Face Unlock" is still labeled the same.
I say don't drink and drive, you might spill your drink. Before you get behind the wheel just stop and think.
Than the simple slide lock. I know a few people who use a PIN to lock their phone. But most people I know do not, including myself. I would think the face recognition would be the equivalent of a slide lock. And depending on how it works, perhaps more convenient (I never saw how it works on the phone). Was it advertised as a way to keep the NSA out of the phone? Or as a replacement for a keeping you from butt dialing people? If the latter, then I don't see the problem.
Security can easily be improved by the use of a 4 digit pin-code which is to be tattooed to the forehead of the owner and automatically read using OCR.
My karma ran over your dogma
With the SII it also works. I took a picture with one phone and showed to the other phone to unlock it.
That works. No problem.
But I think it's also marked as insecure, so this wasn't really a surprise actually.
Privacy is terrorism.
Seems to stump the FBI.
http://www.geekosystem.com/fbi-cant-crack-pimp-phone-pattern-lock/
Join the Slashcott! Feb 10 thru Feb 17!
...their device would never recognize a face from a mere photograph!
My voice is my password, please verify me...
Something you are...
Something you have...
Something you know...
Of course you can unlock with a picture of the user! I have no seen this particular model from samsung but if it is like most other smart phones it only has a single camera. It is doing face recognition on 2 dimensions, which though powerful, has its limitations.
To the phone the whole world only has two planes!
the best solution to this would be to use 3-D face recognition, which would involve having two cameras on the phone side by side, to do stereo imaging.
of course this is not full proof either, because you could a bust (sculpture) of a person to trick it as well. But unless your an old european dude or a founding father its highly unlikely.
It's not a security feature and it should not be. It's there for convenience. nothing more. :)
It's just like slide to unlock, but all you have to do is look at the camera and voila
that starting your post in the subject and continuing in the body is bad form.
By "someone" I mean me.
With this reply.
Don't do it.
Ever.
Just do a funny face when setting up your unlock picture.
Use another body part.
"Goat Unlock"?
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
THis has been reported before on when Face unlock first came out and its not like theres been a new release of it touting better security or anything. Google Advise this is low security. Why is this news ?
What if my login screen uses a picture of a vampire?
"Believe me!" -- Donald Trump
Gimme the cassssh!
http://www.youtube.com/watch?feature=endscreen&NR=1&v=nah_3vO0uhM
Use a print of goatse.cx and you'll always be safe in the knowledge that even if you forget to carry the print with you, you can still, at a push, access your phone! :D
Security researchers also were able to trick the phone by decapitating the owner and using the head to unlock the phone.
It's an ICS feature and has been compromised with this trick since it was released:
http://www.youtube.com/watch?v=BwfYSR7HttA
Back in 2008 I had a face-unlock feature-phone in Japan, and they have been around a lot longer than that, so how is the Samsung one different than the one I had?
Put it another way, we're all supposed to be smart people here - the phone only has a 2D camera, presumably, so it can only compare what you looked like before to what you look like now and see how similar it is. A good photo of you is going to work well. Even if it could measure the distance to gauge the size of your head, the attacker could still use a real-life-size photo to unlock it.
Presumably if you drop your phone on the train or something, the person who picks it up won't even know you, much less have your photo.
Somebody to loooooove.
Apple Siri uses an Infrared light based face detection sensor on the current IPhone to reliably detect a human face is being held in front of it.
Using Face unlock in combination with such a sensor would defeat simple photo-based attacks.
So instead of a password to get in, you can use a password OR a facial recognition system. What improved security!
But, the question is, can it recognize black people? (see HP's awesome facial recognition "oversight")
At least on my Galaxy Note with the ICS 4.0.4 update and it clearly states it's in Beta in the menu options. Not sure if it's also at Beta status on the SGS3 but honestly speaking, only a fool would rely solely on facial recognition.
and I don't even own a smartphone... Just make an extremely goofy face that you'd never have in a picture.
problem solved.
The funny thing is it was the more expensive fingerprint locks that were vulnerable to the paper copy attack. The cheap computer finger scanner require a sophisticated mold.
Not everybody tries to "break" into your phone. We have one of those nerdy colleagues who doesn't know the limits of "own" and "others" phones. He starts using them as if they were his own phones. He wants to "unlock" your phone by sliding and read your email and text messages etc. But he doesn't try to circumvent any existing security measures.
Instead of using a single image they should use a video recorded while sweeping the phone in a semicircle in front of your face, possibly while making a prerecorded funny face at the same time. Try beating that with a photograph! If someone patent this idea, I want to have my share. Slashdot counts as prior art, doesn't it?
It's for protection.
It's to stop someone being able to take your phone/tablet/laptop and then getting at the contents. To that end, having to remember and type in CORRECTLY (with the risk of completely bricking your device for getting it wrong too often) is far too great a cost for the benefit: nobody WANTS what you have on that device enough to bother.
If you have something you need SECURED from deliberate rather than opportunistic attack, then you'd use the more cumbersome methods that are secure and count those costs and risks worth the protection of such valuable and secret a data set.
Most company laptops don't have highly secret and valuable data on them. These methods are merely an easier way to allow you to say to the corporate server "I am me". So as a form of identification for a computer, this is fine. After all, your face is how humans recognise you. Yet that recognition is frequently bypassed (how many times have you mistaken someone for someone else?).
Part of the problem here will be the marketing for these methods. The marketing is marketing them as security methods. To be used instead of any password or two-factor authentication method. It is not.
You don't use one-time cypher pads to lock your home computer, do you? Those are more secure than passwords alone. But you don't use them, do you. Because they're not worth the effort.
These authentication methods are condoms replacing the chastity belt of passwords. We don't use themfor the same thing, even though they can manage to do some of the work of each other (you can't get pregnant if your chastity belt works, but you wouldn't give your wife a pack of condoms to protect against infidelity when you would otherwise have used a chastity belt).
No it wouldn't.
There is no infrared "sensor" on the iPhone; all digital cameras pick up on infrared light. Infrared light would be no different to a camera than using face unlock under any coloured light.
Not quite. Siri has activated a number of times when the screen was still on and I put it in my pocket. Even if locked, e.g. I pull it out to check time, put it back in pocket before screen goes black. This hasn't resulted in a pocket dial yet, but it's at least possible.
Visit http://samsunggalaxysiiicellphone.com/ to get best price and deals for Samsung Galaxy S III