Samsung Galaxy S3 Face Unlock Tricked By Photograph

AlistairCharlton writes with a story about an Android Face unlock security system that could use some tweaking. "Android's Face Unlock security on the Samsung Galaxy S3 can be tricked into unlocking the phone by showing it a photograph of the owner. In a test carried out by IBTimes UK, we found that the Galaxy S3 cannot distinguish between a photograph and a real person, leading us to suggest users should select a more secure way of locking the phone, such as with a PIN or password."

Comments

Can you see it?

[alexbgreat]

This is my shocked face...

Not Intended to be Industrial Grade

[nahdude812]

Face unlock is not intended to be industrial grade security. By its nature it has to be tolerant to unlocks (it would suck if you couldn't unlock your phone after a haircut or beard trim, for example). It's intended to prevent casual perusal by someone who finds the phone sitting around. They've added some little things like requiring some movement in the face (eg, blinking), so it's mildly surprising that a static photo can trick it. But it's not especially worrying either - again, it's meant to be one step above slide to unlock.

It's almost like stating that the standard "slide to unlock" is insecure because anyone can slide that button! The statement is true, but it misses the point.

Also, a quote from Samsung taken directly FTFA:

"Therefore, users with sensitive information on their phone are advised to use higher-protection security features, such as pattern, pin, or password unlock."

Re:Not Intended to be Industrial Grade

[localman57]

It's not necessarily pointless, depending on who your attacker is. Against a sufficiently advanced and determined attacker, nearly all security attempts are pointless, because all can be broken, even if a rubber hose must be used. If your goal is to simply prevent someone from casually picking up your phone and browsing through your inbox, it might be worthwhile. Additionally, if the "gimmick" aspect leads some people to use it who would not otherwise use a PIN (which is very un-gimmicky), there may be some value in it.

Finally, I see this as potentially very useful as a two-factor authentication for cases where the person who has the phone doesn't know to whom it belongs. e.g. they found it in a bar. If brute-forcing the face recognition is somewhat difficult, it could be added to a pin code for extra security. All of this assumes that there isn't an easily exploited backdoor or weakness via USB or other interface.

Re:Not Intended to be Industrial Grade

[KhabaLox]

Want security, pick a strong passsword.

Exactly. That's why I use a picture of Rainer Wolfcastle for my Galaxy.

Re:Not Intended to be Industrial Grade

[icebike]

Face unlock is not intended to be industrial grade security. By its nature it has to be tolerant to unlocks (it would suck if you couldn't unlock your phone after a haircut or beard trim, for example). It's intended to prevent casual perusal by someone who finds the phone sitting around. They've added some little things like requiring some movement in the face (eg, blinking), so it's mildly surprising that a static photo can trick it. But it's not especially worrying either - again, it's meant to be one step above slide to unlock.

It's almost like stating that the standard "slide to unlock" is insecure because anyone can slide that button! The statement is true, but it misses the point.

Also, a quote from Samsung taken directly FTFA:

"Therefore, users with sensitive information on their phone are advised to use higher-protection security features, such as pattern, pin, or password unlock."

Further this is a standard feature of ICS, and nothing to do with Samsung. Its on all the HTC phones that ship with a front facing camera and ICS installed.
Want to blame someone, blame Google for adding this silly feature to Android.

Re:Not Intended to be Industrial Grade

[liquidsin]

just use a picture of your balls; in theory it should be easier to keep would-be hackers from getting a picture of your balls, and it's only slightly awkward to shove your hand down the front of your pants every time you'd like to use your phone.

Re:Not Intended to be Industrial Grade

[crakbone]

Actually I see this as preventing the casual phone check by a police officer. It becomes a locked container and they then legally have to go to more extremes to open it. In some cases a warrant.

Re:Not Intended to be Industrial Grade

[CCarrot]

Actually I see this as preventing the casual phone check by a police officer. It becomes a locked container and they then legally have to go to more extremes to open it. In some cases a warrant.

Or they just hold it up 'Is this your phone, sir? Oh look, it's unlocked...'

Feature...

[N0Man74]

This is a "feature", not a "bug". In fact, it's a "safety feature".

Now there is no need for someone to kill you, skin your face off, and make a mask out of it to break into your phone (like in the movies). They can just take a photo of you from a telephoto lens. Sign me up!

even more dangerous...

[Anonymous Coward]

It would be even more dangerous if someone compiled a whole book of face photographs... i dunno, maybe they could call it a "face book" or something like this.

Solution

[mdarksbane]

Use someone *else's* face as your unlock.

Like Teddy Roosevelt.

And then put that picture as your login screen, so it'll log you in if you point at a mirror.

It'll still be a problem if Zombie Teddy Roosevelt steals your phone, but how likely is that...

Re:Solution

[XiaoMing]

Use someone *else's* face as your unlock.

Like Teddy Roosevelt.

And then put that picture as your login screen, so it'll log you in if you point at a mirror.

It'll still be a problem if Zombie Teddy Roosevelt steals your phone, but how likely is that...

So you now have a cell-phone that's only useful near mirrors.

Solution: Silly faces!

[LordRobin]

There's an easy solution! Just cross your eyes and stick out your tongue when taking the security image! Of course, the people on the bus might think you're a little looney each time you unlock your phone, but that's the price you pay for security!

------RM

Informed decision?

[astrodoom]

No information on the test they performed whatsoever, no shots of the photos used, no information on how they overcame (or if they did at all) the supposed blinking requirement. This news site has a low opinion of their readers to not even include the simplest information.

Last I checked....

[SIR_Taco]

Last I checked on my Samsung Galaxy SII (with ICS 4.0.3), the "Face Unlock" feature was aptly labeled as "Low Security, Experimental".

The only item marked as "High Security" is the password option.

I don't have an S3, but from what I've read the UI/OS version is pretty close at the moment (4.0.3 vs. 4.0.4). And I do believe, correct me if I'm wrong, that "Face Unlock" is still labeled the same.

Face unlock is not a security feature

[Anonymous Coward]

It's not a security feature and it should not be. It's there for convenience. nothing more.
It's just like slide to unlock, but all you have to do is look at the camera and voila :)