Slashdot Mirror
Hackers Say They've Broken Face ID a Week After iPhone X Release (wired.com)
Andy Greenberg, writing for Wired: When Apple released the iPhone X on November 3, it touched off an immediate race among hackers around the world to be the first to fool the company's futuristic new form of authentication. On Friday, Vietnamese security firm Bkav released a blog post and video showing that -- by all appearances -- they'd cracked Face ID with a composite mask of 3-D-printed plastic, silicone, makeup, and simple paper cutouts, which in combination tricked an iPhone X into unlocking. That demonstration, which has yet to be confirmed publicly by other security researchers, could poke a hole in the expensive security of the iPhone X, particularly given that the researchers say their mask cost just $150 to make. But it's also a hacking proof-of-concept that, for now, shouldn't alarm the average iPhone owner, given the time, effort, and access to someone's face required to recreate it. Bkav, meanwhile, didn't mince words in its blog post and FAQ on the research. "Apple has done this not so well," writes the company. "Face ID can be fooled by mask, which means it is not an effective security measure."
.... ain't all asian all look alike anyway?
Authentication is predicated upon knowing a secret, which your face isn't
If you remember, Touchid was similarly soon broken, and it also required quite some commitment from the hacker.
Still, for most people the security of TouchId was good enough and practical in use.
I expect the same with FaceID. For the utmost in security, users can always opt for a passcode.
... that its "Bphone the best smartphone the world" (2015). It sank without a trace.
I'd treat that their claims that "Apple has done this not so well" and "Face ID can be fooled by mask, which means it is not an effective security measure" with a grain of salt. Of course their company is from Vietnam, "land of fakes" https://tuoitrenews.vn/news/ci... where scandal after scandal of dangerous, counterfeit and frank outright fraud is commonplace.
Unfortunately I have firsthand experience of this :(
So, what exactly is wrong with having to enter a passcode, anyway?
FaceID reminds me of this xkcd comic.
Except that you no longer need the wrench...
Fanatically anti-fanatical
Your mission, should you choose to accept it, is to somehow sedate the subject and create a life cast of their face without them figuring out that you're doing it. You must then jump though a bunch of other hoops in order to unlock the subject's phone. You are under no circumstances to use the subject's own face to unlock their phone. Should you or any of your IM force be caught or killed, you will be mocked mercilessly on Slashdot.
If you get arrested, they unlock the phone by holding it up to your face. That doesn't even require a mask. It's the opposite of security.
What happens when a person suffers an injury to their face? A serious black eye, swelling, etc? Do they get locked out of their phone at a time when that's probably the last thing they want to have to deal with?
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
fingerprint scanning increases the cost of the phone. Face recognition does not require any additional hardware.
The researcher shows that the phone unlocks when presented with his face, but it doesn't show the enrollment or training phase.
For the sake of transparency, it would be nice to see that enrollment was done on his normal face without using any part of the mask or other shenanigans. And since the scanner apparently 'learns' from failed scans where you immediately enter the (correct) passcode, that's another route by which he could corrupt the enrolled data -- he could scan the mask and then enter his passcode enough times that it 'learns' the wrong thing.
If either of those are true, it only shows that the authorized user can enroll data that's close enough to both his real face and a mask that both unlock it.
fingerprint scanning increases the cost of the phone. Face recognition does not require any additional hardware.
Not true. There is both a structured light transmitter and receiver which are additional hardware compared to previous iphones. There may also be a separate processor for data processing of these modules.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
Assuming that it's sufficiently accurate, Face ID is a great authentication system for inconsequential people. IE: People who don't have a lot of money nor power, which is a very large portion of the population.
For those that do have some kind of responsibility, ie: managers, IT staff, etc, it's bad.
If said individuals work for a major corporation and/or deal with sensitive information, it's downright idiotic. A biometric authentication system that doesn't even require you to be near the individual to unlock a device with sensitive data is foolish, especially today when people have access to 3D cameras and printers, and can do a targeted attack relatively inexpensively.
It's not Mission Impossible type stuff, but it's not far off.
The researchers concede, however, that their technique would require a detailed measurement or digital scan of a the face of the target iPhone's owner. The researchers say they used a handheld scanner that required about five minutes of manually scanning their test subject's face.
So they haven't really broken anything. It turns out if you sit there and let them scan your face for 5 minutes they can make a model that can bypass a scanner in a consumer device. I'm surprised that it isn't possible to make a perfectly matched face that could fool a human with that kind of scanning.
Non-story.
- Vincit qui patitur.
In either case you can press the power button 5 times quickly to disable TouchID and require the passcode to be entered.
If it is no worse than a thumbprint, then why is it news? We've had fingerprint based unlocking for years--did you just now find out about it?.
Also, FaceID doesn't work if you're unconscious.
Also, if somebody is willing to beat you to death to get into your locked phone, then what form of security is going to stop that?
It seriously took 10 seconds to completely destroy your argument, maybe try harder next time.
Out of curiosity: IIRC, the iPhone projects some IR dots on the face, and reconstructs a 3D model based on the distortion of the projected pattern using a rather regular 2D camera.
Is that pattern fixed?
If so, would it be possible to block the projection, and "simply" show the sensor the pattern that should appear?
I bet it's not that easy, but i'd like to know why?
Does she give you a secret passcode when you pick her up from daycare? No? Then how do you know that she's not an imposter? After all, her appearance is public knowledge.
Here's how:
1. trusted authentication hardware/sensors : You trust your own eyes, you are pretty certain that no one has done a MIM attack in the path from your visual cortex to the child's face.
2. weighing cost-to-defeat vs. benefit : sure it's possible to find another child and do elaborate plastic surgery or a mask, but that's a fantastical notion considering the costs involved when weighed against any possible benefit
3. chain of custody : Your daughter has been with you or with people you trust the entire time. One of them likely would have warned you that a black van appeared, took your daughter for a couple hours, and then returned her
4. If any of #1-#3 are in doubt then you can always fall back to asking her something only she would know (i.e., a secret)
This is, more or less, exactly the way that TouchID or FaceID works. The sensors are in a secure, encrypted domain that's outrageously difficult to hack and would require getting your phone out of your possession without you knowing it. Successfully hacking into your phone would be extremely expensive and thus not worth it. And whenever Apple becomes a little suspicious that someone is trying to hack in (i.e., when the phone gets rebooted, when you hit the power button 5 times, when the SW is updated, after 48 hours of you not logging in) then it reverts to a mode where it insists on you entering a secret.
You have made the child-like mistake of thinking that any form of security that is theoretically breakable is worthless. In fact, there is no such thing as perfect security--the goal is ALWAYS to increase the cost & effort required such that breaking the security is not economically practical.