10-Year-Old Boy Cracks the Face ID On Both Parents' IPhone X (wired.com)

An anonymous reader writes: A 10-year-old boy discovered he could unlock his father's phone just by looking at it. And his mother's phone too. Both parents had just purchased a new $999 iPhone X, and apparently its Face ID couldn't tell his face from theirs. The unlocking happened immediately after the mother told the son that "There's no way you're getting access to this phone."

Experiments suggest the iPhone X was confused by the indoor/nighttime lighting when the couple first registered their faces. Apple's only response was to point to their support page, which states that "the statistical probability is different...among children under the age of 13, because their distinct facial features may not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate." The boy's father is now offering this advice to other parents. "You should probably try it with every member of your family and see who can access it."

And his son just "thought it was hilarious."

Comments

Biometrics are not passwords

[bradley13]

Biometrics are user-ids, not passwords.

There are three aspects to security: something you are, something you know, something you have. Implement two for rudimentary security, implement all three for good security.

- Something you are: User ID, biometrics, or some other public information that serves to identify the person.

- Something you know: Typically a password, used to prove the identity

- Something you have: Second factor, used to prove that the password and identity were not stolen.

Face-ID and fingerprints are insecure and easily fooled.

Re:Biometrics are not passwords

[AmiMoJo]

Fingerprints seem to be pretty good in the real world. The FBI can't seem to crack them. UK security forces can't reliably crack them, so they have taken to following people until they unlock their phone and then staging a fake mugging to grab it in that state.

Okay, maybe the NSA can get in, but for most people a good fingerprint scanner seems to be a reasonable option. The main issue is the lack of a panic button on some of them, i.e. something you do to disable it and require require the passcode. Apple lets you press the power button 5 times quickly, on most Android devices holding the power button for a few seconds works.

Re:Scary

[viperidaenz]

It also gives your child full access to your ApplePay account. which by default only requires FaceID to authenticate.

I've been sort of expecting this to happen

[Lisandro]

Tim Cook's claim that FaceID is 20x more accurate than TouchID was kinda ridiculous. It is a neat technology and from what i hear it works well, but it is impossible to have face recognition that doesn't trigger false positives with relative ease. Telling people there's a one in a million chance that FaceID will mistake someone else face with yours is irresponsible.

Got issues?

[sjbe]

I've been completely blackballed throughout entire corporations just because of the brand of mouse I chose to buy, or the fact I refuse to use Facebook.

Oh bullshit. No corporation will give a shit about what brand of mouse you use unless you are a flaming asshat about it or somehow manage to violate their corporate IT rules. I don't use Facebook either and I have yet to run into a corporation that gives a shit about that even a little bit. Even if what you say is true that sounds like it is you that is the issue.

If you can't imagine anything in your phone (or not in it, for that matter) that anyone would take offense to, I suggest you either must not use it or you're just really naive.

If you work in a workplace that is THAT hypersensitive then I suggest you find a new and better employer. I can confidently say that there is absolutely nothing on or missing from my phone that I'm even a little worried about my coworkers getting offended over. That would be equally true of every employer I've ever worked for which at my age is quite a few of them. I would have some concerns about them getting access to some banking and financial info but that is the worst of it. Nothing there I'm the least bit embarrassed about including the contents of my emails and correspondence. I'm concerned about serious things like identity theft. That's not to say some people don't have some personal things they need to hide sometimes but if access to your phone is a concern then I suggest you keep such data off your phone.

Big companies generally devolve into popularity contests.

If you think that then I think you have serious social issues that no one here can help you with.