Slashdot Mirror


10-Year-Old Boy Cracks the Face ID On Both Parents' IPhone X (wired.com)

An anonymous reader writes: A 10-year-old boy discovered he could unlock his father's phone just by looking at it. And his mother's phone too. Both parents had just purchased a new $999 iPhone X, and apparently its Face ID couldn't tell his face from theirs. The unlocking happened immediately after the mother told the son that "There's no way you're getting access to this phone."

Experiments suggest the iPhone X was confused by the indoor/nighttime lighting when the couple first registered their faces. Apple's only response was to point to their support page, which states that "the statistical probability is different...among children under the age of 13, because their distinct facial features may not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate." The boy's father is now offering this advice to other parents. "You should probably try it with every member of your family and see who can access it."

And his son just "thought it was hilarious."

187 of 300 comments (clear)

  1. Sounds like excuses by Anonymous Coward · · Score: 5, Funny

    You're looking at the phone wrong, etc., etc., etc........

    1. Re:Sounds like excuses by Anonymous Coward · · Score: 1

      They did not add logic when they were designing the phone. What makes you think they would add logic now?

      Apple is now a company of mindless drones carrying on after its creators have long since gone.

    2. Re:Sounds like excuses by Anonymous Coward · · Score: 1

      They did not add logic when they were designing the phone. What makes you think they would add logic now?

      Is that a serious question? It's kinda dumb.

    3. Re:Sounds like excuses by sittingnut · · Score: 5, Funny

      boy is obviously a disguised russian hacker.

    4. Re:Sounds like excuses by mark_reh · · Score: 2

      Yeah, because you're going to be using the phone under optimal lighting conditions all the time, anyway...

    5. Re:Sounds like excuses by hcs_$reboot · · Score: 2

      No excuse. iPhone X hacked by a X year old. Normal.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    6. Re:Sounds like excuses by Obfuscant · · Score: 1

      There was no hacking or cracking here. It is a flaw in the system.

    7. Re: Sounds like excuses by Obfuscant · · Score: 1

      Please elaborate how hacking is now qualified when a 10 year old trying something when it shouldn't work in fact does work. That's like someone saying to a child "you're not playing with the toy correctly"

      He picked it up and looked at it. And it unlocked.

      That's not "hacking". That's not "cracking". That's "looking at a device in the same way everyone else looks at it."

      I suppose you'd call this kid a lock-picking genius if he walked up to an unlocked door and it opened when he pushed on it.

    8. Re: Sounds like excuses by hcs_$reboot · · Score: 1

      But he intentionally tried to open the device, knowing it was not his. Hacking.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    9. Re:Sounds like excuses by antdude · · Score: 1

      And wearing a mask!

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
    10. Re:Sounds like excuses by hcs_$reboot · · Score: 1

      * their own 'unique' interpretation on how to write 350 in roman numerals

      Thanks for the explanation. However, 350 is CCCL not LCD ...

      --
      Slashdot, fix the reply notifications... You won't get away with it...
  2. That's funny... by Anonymous Coward · · Score: 1

    The password on my $79 android phone seems to keep it safe...

    1. Re:That's funny... by AC-x · · Score: 2

      The fingerprint reader on my $250 dollar Android phone keeps it safe enough and makes it quick to unlock.

    2. Re:That's funny... by jellomizer · · Score: 1

      Which is a feature you can turn on on the iPhone too. So I don’t get your point.
      I never bought into the hype of Apples million to one FaceID rate because how could they get a good random sample size from their employee work force. Even Apples size you tend to get the same sort of people. And you will not have many generations of people and twins to check it out.
      That said Biometric are often still better than passwords because they are much easier to use and prevents people from having too simple passwords or none at all.
      Granted you kid getting access to your phone is often embarrassing, but if one of your coworkers or your boss or a stranger gets access to it it could be devastating.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    3. Re:That's funny... by F.Ultra · · Score: 1

      I never bought into the hype of Apples million to one FaceID rate because how could they get a good random sample size from their employee work force

      In other words FaceID is really, really good at distinguishing between different types of man buns.

    4. Re: That's funny... by bsDaemon · · Score: 4, Insightful

      Biometrics are not better than a password as a single method of authentication unless your data is worthless.

      Passwords can be changed/rotated indefinitely. You only have one face, two eyes and 10 fingers.

      Only idiots leave passwords on sticky notes. Literally everybody leaves fingerprints around, unless they donâ(TM)t have finger prints, in which case a finger print reader is useless to them anyway.

      How âoeeasyâ it is to get you to give up a password depends on you. How easy it is to force your finger onto a finger print reader, less so.

      Biometrics, being a physical characteristic of a person are great for indentification, i.e. as a replacement for a username. Theyâ(TM)re also perfectly reasonable as part of a multi-factor authentication. Iâ(TM)ll combine finger print + the HMAC SHA challenge-response from yubikey or PKI from a smartcard for accessing my laptops for instance.

    5. Re:That's funny... by Antique+Geekmeister · · Score: 2, Insightful

      Quick to unlock, yes.

      There is a real risk of "gelatin fingers". There are many videos, and some reliable newspaper stories, of people replicating fingerprints very successfully with gelatin or even Play-Doh. The approach was well documented in2002, at https://cryptome.org/gummy.htm .

    6. Re: That's funny... by mark_reh · · Score: 1

      "fectal"???

    7. Re:That's funny... by Imrik · · Score: 2

      I kind of believe their rate, but you have to remember that they're counting it as if a random person in the entire world got your phone. People that are related to you or even just people with similar ancestry are far more likely to be a match.

    8. Re:That's funny... by AC-x · · Score: 1

      That's why I qualified it with safe enough - for me it's the right balance between convenience and difficultly to break.

    9. Re:That's funny... by I75BJC · · Score: 3, Interesting

      I continue to use the good old pin number. Skipped Touch ID -- since the LEOs, by court decree, can force me to swipe my finger. The above posters is Not immune from a LEO forcing his finger across the fingerprint reader. That's a flaw in his "security" plan. I will skip the Face ID feature for the same reason -- the LEOs can force you to look at your phone, legally. Apple increased the pin number from 4 to 6 digits which increased security greatly. New gadgets work well but not so well with LEOs. LEO: You won't mind me searching your phone/camera/computer/car/house since you have nothing to hide, will you? ME: That's the very reason. Since I have nothing to hide and since I'm not involved, you are wasting precious LE time by search my car/house/computer/phone/camera when you could actually be working on profitable tasks.

    10. Re:That's funny... by tsqr · · Score: 1

      Dude, I'm much more worried about bolt cutters or even sharp knives with fingerprint-based security.

      I like my fingers ATTACHED to my hand.

      Two questions:

      • What do you have on your phone that would motivate someone to cut off your finger to get in?
      • If someone threatened to cut off your finger, wouldn't the smart thing be to just unlock the phone for them?
    11. Re:That's funny... by jbmartin6 · · Score: 1

      The idea of risk typically includes probability, which in the case of gelatin fingers is near zero for most people.

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    12. Re:That's funny... by jbmartin6 · · Score: 4, Informative

      I recently encountered another issue with the TouchID. I'm not clear on the logic, but if you reboot the phone you need to use a PIN to unlock anyway. Only after the initial PIN unlock can you use TouchID. So use after reboot depends on remembering a rarely used PIN. A recipe for disaster when I traveled recently and my companion could not unlock her phone after turning it on since she could not remember the PIN after so long. Granted, that is user error, but I would never use TouchID since I have to use the PIN enough anyway to avoid forgetting it.

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    13. Re:That's funny... by AC-x · · Score: 1

      I don't know about the phone you're using, but if I need to I can power down without unlocking at which point only the pin will unlock it again. Yes if an officer was quick and grabbed the phone before I was able to do so and physically forced my finger on the sensor then they could unlock the phone, but if they are so desperate to unlock my phone it's unlikely a PIN would stop them either.

    14. Re:That's funny... by AC-x · · Score: 1

      Android seems to periodically ask for the unlock PIN/pattern when using fingerprint unlock, probably to make sure you don't forget it :)

    15. Re: That's funny... by lhowaf · · Score: 1

      If my 10 year old kid goes to that much effort to get into my phone I'll be rather proud of him.

      A 10-year-old boy discovered he could unlock his father's phone just by looking at it.

      Son, I am disappoint.

    16. Re:That's funny... by Mr3vil · · Score: 1

      On every reboot and every 24 hours you have to reauthenticate with your PIN on Android. Probably so someone that stole your device doesn't have ample time to duplicate your fingerprint. I'd rather have Qi charging than the fingerprint reader... as convenient as the fingerprint reader may be.

    17. Re:That's funny... by rogoshen1 · · Score: 1

      i think at this rate paying out of pocket for getting a digit reattached is cheaper than replacing the phone.

    18. Re: That's funny... by AC-x · · Score: 1

      every 24 hours you have to reauthenticate with your PIN on Android.

      Mine does it less than that, maybe once a week or so. Reboot always needs it due to encryption.

      I'd rather have Qi charging than the fingerprint reader... as convenient as the fingerprint reader may be.

      Why not both? Many Android handsets do :)

    19. Re:That's funny... by bingoUV · · Score: 1

      What if the someone doesn't ask but directly cuts it off ?

      Not that the non-askers would care even if I didn't have a fingerprint security on my phone - they might cut off 21 members from my body - just in case.

      --
      Bingo Dictionary - Pragmatist, n. A myopic idealist.
    20. Re: That's funny... by Mr3vil · · Score: 1

      Well, Google's argument for dropping Qi on Nexus 5X/6P was that it'd add thickness. to the device. Which I find questionable given just how thin the Qi receiver coils are. So the only real remaining justification for gutting the feature is expense. And really if I had to choose Qi or Fingerprint, I'd rather have Qi. But both would not be unwelcome, of course.

    21. Re: That's funny... by NoZart · · Score: 1

      the 24 hour reauthentication only comes up when the phone wasn't being used in the last 24 hours (at least mine does that).

    22. Re:That's funny... by sexconker · · Score: 1

      Compared to up-to-date Android, which is riddled with known security holes.

    23. Re:That's funny... by Antique+Geekmeister · · Score: 1

      It's more work. But the 2002 paper on geletin fingerprints showed how easy they were to obtain from even crude copies, including those left on smooth surfaces and those stored in police files. Mythbusters even did a very effective demonstration both of the gelatin fingers, and of how easy it was to obtain the original fingerprints from even a suspicious person.

    24. Re: That's funny... by PlaynBass · · Score: 1

      A ready-made excuse to justify buyer's remorse for an overpriced piece of techno-junk.

      --
      PlaynBass
    25. Re:That's funny... by PlaynBass · · Score: 1

      Oh, but police overtime is VERY profitable... especially if it's in-house and no one is shooting at you.

      --
      PlaynBass
    26. Re:That's funny... by SirSlud · · Score: 1

      I think it's adorable that you think Apple wouldn't have any way of getting anyone other than the people that work there for testing their devices.

      --
      "Old man yells at systemd"
    27. Re:That's funny... by I75BJC · · Score: 1

      Point Taken. I guess I watch too many LE shows where the LEOs care about catching the preps AND I know too many LEOs to think the slackers are more than a minority.

    28. Re:That's funny... by I75BJC · · Score: 1

      Yes, the LEOs can get a legal right to access my phone under certain and specific circumstances. But even in those circumstances I cannot be compelled to surrender my PIN cod. But I can be compelled to surrender my finger and my face to unlock my phone. It isn't about stopping LEOs from accessing my phone but making sure that LEOs do so legally. If LEOs access my phone illegally -- well the average USA citizen isn't protected by anyone except themselves and that's a different discussion.

    29. Re: That's funny... by AC-x · · Score: 1

      Sure, but my point is I can turn my phone off without having to unlock it, at which point a pin is required, and LEOs have the technical ability to bypass pins on at least some phone models.

    30. Re:That's funny... by PlaynBass · · Score: 1

      I have had very limited contact with LEOs, none of them resulted in the capture of the perpetrators.

      I guess I just encountered the lazy or overworked ones, or they just didn't know how to follow up on the leads I gave to them.

      I was able to get a quicker response on my own just over the phone, in response to a debit card theft. The local sheriff's department quickly suspended the case. Just not important that my entire bank account had been wiped out. I eventually got all my money back, but without much help from the LEOs who worked the case. It took a couple of weeks just to connect with them to give them my evidence.

      Color me 'not impressed'.

      --
      PlaynBass
  3. Just curious... by vasilevich · · Score: 4, Interesting

    I wonder, can monozygotic twins unlock each other's phones? That would be even more hilarious.

    1. Re:Just curious... by serviscope_minor · · Score: 5, Interesting
      --
      SJW n. One who posts facts.
  4. And this is why I want a fingerprint scanner ... by Hal_Porter · · Score: 1

    ... and on the front too, not the back.

    I.e. you need to give people an option for no security, passcode, fingerprint or FaceID and let them decide on what balance of security and convenience they want.

    Right now it seems like the industry is either putting fingerprint scanners on the back or omitting them entirely. It's another example of a useful feature being omitted for mostly aesthetic reasons - i.e. bezel-less displays. Of course it saves on component cost too.

    --
    echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
  5. The son is correct... by Anonymous Coward · · Score: 1, Informative

    It IS hilarious. It's legitimately an odd way to authenticate anyway, and less secure than fingerprints, and way less secure than constantly typing annoying passphrases. It should be no surprise that there's endless ways to fool it.

  6. Re:cue the apple fanboy by Opportunist · · Score: 1

    Cue me asking him why that hilariously overpriced phone then not only implemented it but also announced it as the biggest thing since sliced bread.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  7. Dang those shape-shifting children's faces! by antek9 · · Score: 4, Funny

    Kids as skeleton keys, that would be so funny if it weren't the security desaster it actually is. What remains to be shown now is that a random group of, say, 10 children with no relation to an iPhonX (previous...) owner has a more than 10% chance of unlocking Face ID.

    --
    A World in a Grain of Sand / Heaven in a Wild Flower,
    Infinity in the Palm of your Hand / And Eternity in an Hour.
    1. Re:Dang those shape-shifting children's faces! by religionofpeas · · Score: 3, Funny

      Next item: FBI hires a bunch of 13 year old kids to unlock phones confiscated from criminal suspects.

    2. Re: Dang those shape-shifting children's faces! by Anonymous Coward · · Score: 1

      If you got the criminals phone there is a great chance you also have the criminal... and just can use his face to unlock... simple !

  8. So it's defective by design then? by Anonymous Coward · · Score: 1

    "the statistical probability is different...among children under the age of 13, because their distinct facial features may not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate."

    So what they're saying is that all you need are a few foam heads with some generic features, and you should be able to unlock any iPhone X out there?

    What sort of bullshit security is this? By admitting this, they've basically admitted the entire feature cannot be trusted.

    1. Re: So it's defective by design then? by viperidaenz · · Score: 1

      ... he looks like his parents, but he can unlock both their phones, and they apparently can't unlock each others phones so they don't look like each other. But their 13 year old son looks like both of them.

    2. Re: So it's defective by design then? by Hognoxious · · Score: 5, Funny

      they apparently can't unlock each others phones so they don't look like each other

      Perhaps they aren't from West Virginia.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    3. Re:So it's defective by design then? by vux984 · · Score: 1

      Yes its defective by desgin. I made the same comment when it was announced. Apple claimed a pretty tiny false positive rate, but if you think about it, it is not a random sampling, it is heavily biased toward people close to you.

      Lets say there was a 1 in a billion false positive rate. That's not so bad, maybe 7 people in the world could unlock your phone right?

      But where do people look the most like you?

      Unless you've recently immigrated, statistically the odds are the people in living on the same continent look more like you on average than the people on other continents, statistically the people in your country look more like you than people in other countries, the people in your town look more like you than people in other towns... and statistically the people in the bedrooms down the hall in the same house look more like you than anyone else in the world.

      So yeah... statistically 7 people in the world can unlock your phone... 4 of them are related to you, and probably live within 100 miles of you, and 1 or 2 of them live in your house; and are most likely the people who would try and unlock your phone.

      Defective by design.

    4. Re: So it's defective by design then? by TheFakeTimCook · · Score: 1

      Or Amish. Pretty small gene pool there.

      And yet, they ended-up with the long-life gene.

      How does THAT work?!?

    5. Re: So it's defective by design then? by Hognoxious · · Score: 1

      Are they the ones who don't drink, smoke, fornicate, play computer games, or gamble?

      Perhaps they don't live longer - it just seems like it.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    6. Re: So it's defective by design then? by TheFakeTimCook · · Score: 1

      Are they the ones who don't drink, smoke, fornicate, play computer games, or gamble?

      Perhaps they don't live longer - it just seems like it.

      They actually do ALL of those things. They just try not to get caught by the Church Elders doing it!

    7. Re: So it's defective by design then? by blindseer · · Score: 1

      "I guess she's my cousin but she needs some sweet lovin' anyway!"

      https://www.youtube.com/watch?...

      --
      I am armed because I am free. I am free because I am armed.
  9. Scary by highvoltage5916 · · Score: 5, Interesting

    That's scary, that puts your children at risk at being kidnapped or being brought in by aggressive authorities in an attempt to get access to your device. Parents should rather avoid using this feature altogether.

    1. Re:Scary by viperidaenz · · Score: 5, Insightful

      It also gives your child full access to your ApplePay account. which by default only requires FaceID to authenticate.

    2. Re:Scary by humasyed · · Score: 1
    3. Re:Scary by thegarbz · · Score: 1

      If you're THAT worried about the authorities, maybe it's time to seek asylum in a 1st world country.

    4. Re:Scary by nealric · · Score: 1

      We've only seen isolated incidents of this working. Doubtful such attempts would be successful in 99% of cases. Face ID does not work with my son, who everyone says looks a lot like me. I suppose you can always test it on your child if you are worried about them getting into your phone, and use the passcode if it works.

      At the end of the day, all this depends on how much security you really need. There's nothing that can't be cracked by someone with physical access to the device that is sufficiently motivated/resourced. No matter what method you use, someone can always put a gun to your head and demand you unlock the device. If the authorities are demanding your phone be unlocked, odds are you have bigger problems than device security to worry about.

  10. Defective by obscurity by stooo · · Score: 1

    Yep.
    Security by obscurity -> defective.

    >> "the iPhone X was confused by the indoor/nighttime lighting"
    Security by obscurity. Told you so.

    --
    aaaaaaa
    1. Re:Defective by obscurity by viperidaenz · · Score: 1

      Yep.
      Security by obscurity -> defective.

      >> "the iPhone X was confused by the indoor/nighttime lighting"
      Security by obscurity. Told you so.

      and they advertised it works perfectly fine in the dark, as your face is illuminated by 30,000 infrared dots from the true depth camera.

    2. Re:Defective by obscurity by Bing+Tsher+E · · Score: 1

      'True Depth' is a trademark. Like 'Altivec' and 'Power PC.' Make sure you capitalize it or the branding lawyers from Apple will climb up your shorts.

    3. Re:Defective by obscurity by viperidaenz · · Score: 1

      Jokes on them, I'm wearing pants!

  11. Re:And this is why I want a fingerprint scanner .. by richy+freeway · · Score: 1

    I can't get on with fingerprint scanners on the front. The back is where my finger naturally lands as I put my hand in my pocket to get my phone out.

    The front feels clunky and means I have to use two hands to unlock my phone.

  12. Biometrics are not passwords by bradley13 · · Score: 5, Insightful

    Biometrics are user-ids, not passwords.

    There are three aspects to security: something you are, something you know, something you have. Implement two for rudimentary security, implement all three for good security.

    - Something you are: User ID, biometrics, or some other public information that serves to identify the person.

    - Something you know: Typically a password, used to prove the identity

    - Something you have: Second factor, used to prove that the password and identity were not stolen.

    Face-ID and fingerprints are insecure and easily fooled.

    --
    Enjoy life! This is not a dress rehearsal.
    1. Re:Biometrics are not passwords by F.Ultra · · Score: 2

      And even as a user-id it fails miserably as seen in TFA

    2. Re:Biometrics are not passwords by AmiMoJo · · Score: 5, Insightful

      Fingerprints seem to be pretty good in the real world. The FBI can't seem to crack them. UK security forces can't reliably crack them, so they have taken to following people until they unlock their phone and then staging a fake mugging to grab it in that state.

      Okay, maybe the NSA can get in, but for most people a good fingerprint scanner seems to be a reasonable option. The main issue is the lack of a panic button on some of them, i.e. something you do to disable it and require require the passcode. Apple lets you press the power button 5 times quickly, on most Android devices holding the power button for a few seconds works.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    3. Re:Biometrics are not passwords by info6568 · · Score: 2

      I agree that you must use more than one authentication factor.

      In fact, it is terribly dangerous to use biometrics, because when somebody stole your data you are doomed for the rest of your life. And to use in consumer products it is very irresponsible because those products, no matter the brand neither the price, won't be so well designed as security oriented machines.

      Also ... light interferes, children younger than 13 years interfere, photocopies interfere ... this technology is useless on real life scenarios. Maybe the 3rd or 4th editions will be of some use.

    4. Re:Biometrics are not passwords by mjwx · · Score: 1

      Biometrics are user-ids, not passwords.

      Actually they're both but should never be used as the first factor of authentication.

      Face-ID and fingerprints are insecure and easily fooled.

      Yes and no.

      Done properly these technologies are quite effective, however to do it properly you need a $5000 bit of kit at every door and a hefty back end. Fingerprint scanners at Immigration are quite good, but you wont get that level of quality on a £500 phone. So in order to make it work, corners are cut which makes them ineffective as a security measure.

      Besides, people get distracted enough punching in a 4 character pin, I'm not looking forward to the pandemonium face unlock will cause on the road.

      Seriously, automatic gates in a variety of countries combined with biometric passports have made immigration much faster. This is a huge boon for the frequent traveler (as well as many infrequent ones).

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    5. Re:Biometrics are not passwords by MrVictor · · Score: 1

      The FBI are lying. They can 'crack' touchID. If the suspect is alive you can legally compel a fingerprint; if the suspect is dead (and the authorities didn't obliterate the suspect) all they have to do is go down to the morgue and open the device with the dead finger. This is all about a power-grab and the MSM is publishing anti-crypto propaganda to soften up the public's opinion.

    6. Re:Biometrics are not passwords by swillden · · Score: 1

      Biometrics are user-ids, not passwords.

      Completely wrong. Biometrics are neither user IDs nor passwords.

      There are three aspects to security: something you are, something you know, something you have. Implement two for rudimentary security, implement all three for good security.

      "Security" is not the same as "user authentication". Actually "security" isn't even a well-defined concept; it's utterly context-dependent.

      - Something you are: User ID, biometrics, or some other public information that serves to identify the person.

      WTF? Your user ID is "something you are"?

      - Something you know: Typically a password, used to prove the identity

      Knowing something doesn't prove "identity" it proves knowledge.

      - Something you have: Second factor, used to prove that the password and identity were not stolen.

      Again, possession of a second factor does nothing of the sort.

      Okay, look, access control consists of three elements:

      1. Identity
      2. Authentication
      3. Authorization

      Authorization determines what resources a given identity has access to. Authentication validates that a person is connected to an identity. A user ID is a specification of an identity.

      We have devised various ways of authenticating people as identities. They all suck. The reason using multiple methods (factors) is good isn't because there's some inherently ideal way to authenticate, it's because all of the individual methods suck. Using multiple methods allows us to paper over the deficiencies of one method with another.

      For example, passwords suck because they're just information, and information leaks. Phishing, shoulder surfing, keyboard audio, even brute force search, there are lots of ways for an attacker to attempt to get your password, or parts of it. And once the attacker has that information, he can authenticate as you. Further, he can give it to all of his friends and they can all now authenticate as you, too. If the "attacker" is a friend or family member, getting your password is really easy.

      Lots of people think that biometrics suck because it's too easy to get your biometric data. But the biometric security model assumes that your biometrics are public information. The attacker and all his friends already have it. Biometric security is based on the theory that if the device measures a body part then only the person who has that body part is authenticated. It's based on the integrity of the measurement process, not the secrecy of the information measured. But, the measurement process on consumer devices sucks. It's feasible to fake body parts and fool the measurement into accepting them as real.

      As for physical tokens, well, they suck because objects are movable (losable, stealable, etc.). But unlike passwords, they aren't easily copyable, which means that the legitimate user can know the token is gone and can take appropriate steps.

      So, when you combine these things, they cover for each other. Still not perfectly. I can get your password, fake your face/finger, and steal your token, and then I can claim to be you. But it's a lot harder. The token limits my time window, because when its loss is discovered the access will get closed down. The password is easy for friends and family to steal, potentially very, very hard for strangers. The biometric is moderately hard for anyone to fake, including friends and family (assuming it's properly implemented and family faces don't just work).

      Face-ID and fingerprints are insecure and easily fooled.

      There you go with that word again: "secure" (okay, its negation). Secure against who? In what context? These questions matter.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  13. Lock and unlock by mridoni · · Score: 1

    You're not really supposed to "unlock" an iPhoneX. The way FaceID is supposed to work, you pick it up from somewhere and when you instinctively look at the screen, it performs its magic and it's ready, no need to put the right finger on a sensor in the right way, or click on anything. After some time, you're probably going to forget it's actually authenticating you. Unfortunately, while in theory quite convenient, this has several drawbacks in terms of security and usability; it's not really a step forward from fingerprint authentication (that in turn has its problems), more of a step aside.

    1. Re:Lock and unlock by viperidaenz · · Score: 1

      But it also lets you do better Snapchat masks and animated emojis

    2. Re:Lock and unlock by Bing+Tsher+E · · Score: 1

      That makes it completely worth it to have an ugly notch in every video I watch on my phone.

    3. Re:Lock and unlock by nealric · · Score: 1

      In my experience, it does fulfill that promise. It's usually unlocked before I realize it's doing it. The old finger print sensor on my 6s only worked about 80% of the time for me.

  14. That's nothing by Anonymous Coward · · Score: 1

    I found a iPhone X on the floor and unlocked it by mooning it. It was creimer's phone.

  15. Re:cue the apple fanboy by BronsCon · · Score: 5, Interesting

    I predicted this would be cracked with relative ease, but I had no idea it would crack itself. My prediction was based on FaceID using the exact same tech as Microsoft Hello, which was cracked within days of its release. I was more than a little surprised that FaceID was able to be cracked with only a partial mask, when Hello required a full mask. It could very well be that nobody tried the partial mask against Hello but, either way, this is truly disheartening as many people will rely on the feature as though it is actually secure.

    The common defense, of course, is that "they trained it by entering the passcode." On its face, this seems a valid defense, but...

    My wife asks me to do things on her phone all the time while she's driving, so she can keep her eyes on the road. I know her passcode so I can do these things, and FaceID tries to scan every time the screen is turned on. That means, intentional or not, if she had an iPhone X with FaceID enabled, I'd be training it to recognize my face every single time I unlocked it using the passcode. Eventually, we'd both be able to unlock it.

    Since her and I look nothing alike, the phone would ostensibly unlock for anyone with facial features similar to hers or mine, in varied combinations; possibly even within a range between her facial features and mine. Since we look so different form each other, I would be less than surprised if the odds of a random match were way greater than 1:1,000,000, or even the 1:50,000 odds Apple claims for a random fingerprint match, on a device used in such a manner.

    And I wouldn't think that usage pattern is too uncommon; most couples I know who are in healthy relationships ask each other to check messages and whatnot from time to time, which necessitates the sharing of passcodes.

    The "learning" aspect of FaceID is its primary weakness. There are solutions, of course, and a proper implementation would apply them.

    One possible solution would be a "guest" passcode, which does not trigger the learning mechanism. This could also lock out purchases and changes to certain settings. It would just be a good security measure, in general, regardless of FaceID. But, in the context of FaceID, it would all but solve the PIN/passcode "learning" weakness.

    Doesn't do anything for kids or people with siblings, of course. Nor does it do anything for the fact that the 1:1,000,000 claim is explicitly limited to "random matching"; that is, if you pointed the phone at 1,000,000 random people, one of them would unlock it. If you point the phone at 5 people who look a lot like you, one of them will unlock it, as well, and we've seen that borne out in reality. I can take a picture of you as I'm stealing your phone and use it to find 5 people who look enough like you to likely be able to unlock it.

    What I can't to is take a picture of you as I steal your phone and use it to find 5 people with similar fingerprints. The 1:50,000 odds are actually stringer than the 1:1,000,000 in this case, because there's no way around the randomness, other than a direct attack on the scanner itself. Of course, that's entirely possible and not all that difficult; but we've also seen that it's entirely possible and not all that difficult to attack FaceID, so the point is relatively moot, anyway.

    I'd venture that it's easier to, say, walk down a busy city street with your victim's phone and photo and approach someone who looks similar enough to them and ask "have you seen the new iPhone yet?" as you hold it up to their face... than it is to find a clean enough print and reproduce it accurately enough to fool the fingerprint scanner. That's sad, here, is that the bar for fooling the fingerprint scanner was already too low. Apple must be trying to win a limbo competition with FaceID.

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  16. It's time to get rid of Tim Cook by DeplorableCodeMonkey · · Score: 1

    Between this, the debacle of iOS 11 and the fact that the Mac lines have been languishing under him, it's clear they need to get rid of him.

    And no, replacing him with the woman who runs the retail side is not good for the company no matter how good her number is or how desperately they want to put a woman in charge of the richest company in the world.

    At this point, they need a Satya Nadella who can actually get in there, balance both product lines, come up with new ones and reacquire alienated Mac users who've said "I'm not buying this unfixable, glorified iPad that costs $2500-$3000 and has last year's specs." (But hey, it's 1mm thinner!)

    1. Re:It's time to get rid of Tim Cook by PoopJuggler · · Score: 2

      AAPL is at a 5+ year high. Why would they get rid of Tim Cook?

    2. Re:It's time to get rid of Tim Cook by TheFakeTimCook · · Score: 1

      Between this, the debacle of iOS 11 and the fact that the Mac lines have been languishing under him, it's clear they need to get rid of him.

      WHAT "Debacle" of iOS 11? You mean the one where you have to close and reopen Messages to see the last Text? Yeah, that's some Debacle, all right... NOT!

      If you want to see a Debacle, you need look no farther than the Android Bug that puts your phone into an infinite-reboot loop, the ONLY way to recover from said loop is to Factory-Reset your phone, LOSING all your Personal Data, Photos, etc.

      And if you think that the Mac lines are "languishing", then please explain why the MacBook Pro sales are the highest EVER.

      http://www.zdnet.com/article/a...

    3. Re:It's time to get rid of Tim Cook by bursch-X · · Score: 1

      Satya Nadella? Give me a break. That guy is turning Microsoft into another IBM. Yes they're profitable, but they're also utterly irrelevant to anything in tech.

      --
      There are two rules for success:
      1. Never tell everything you know.
  17. Excellent by SuperDre · · Score: 2

    Just shows how crap face-id really is, and it also shows how Apple has tested this feature... like not..

  18. Re: And this is why I want a fingerprint scanner . by richy+freeway · · Score: 1

    I tried it out on my girlfriends phone, didn't like it.

    Maybe it's because I have always had the scanner on the back and I'm just not used to it. It feels really unnatural.

  19. Security lesson: by CarterMeyers · · Score: 2

    Criminals will start using children under the age of 13 to unlock iphones... lol

  20. Laugh today, innovate tomorrow by itamihn · · Score: 2

    We laugh now, but we all know that next year's (or the year after's) flagship Android phones will have Face ID.

    1. Re:Laugh today, innovate tomorrow by Lisandro · · Score: 1
    2. Re:Laugh today, innovate tomorrow by dmesg0 · · Score: 1

      Face unlock was on Android for many years (since Nexus 4 released in 2012 IIRC). It was always advertised as low security convenience feature and not a security solution. OnePlus facial recognition is no different.

    3. Re:Laugh today, innovate tomorrow by thegarbz · · Score: 1

      Whoever modded that informative here's an education for you: he was being funny, Android introduced face unlock several years ago with flagship phones having it years before that.

    4. Re:Laugh today, innovate tomorrow by itamihn · · Score: 1

      I was actually being serious. Face ID is supposed to be using the extra depth sensors for further accuracy. It's supposed to be better than the current Android and Windows Phone face recognition.

    5. Re:Laugh today, innovate tomorrow by sim2lew · · Score: 1

      Actually as he confirmed himself, he was being serious in that he thinks Android will re-hash face recognition because Apple did it.

  21. confused by lighting? by gravewax · · Score: 5, Interesting

    So if it was confused by lighting does that mean apple outright lied how it works? or is that just fanboys trying to make up excuses? if you have something that operates by infrared dots on your face that supposedly works in dark or light how the fuck do you get confused by lighting conditions.

    1. Re:confused by lighting? by Freischutz · · Score: 1

      So if it was confused by lighting does that mean apple outright lied how it works? or is that just fanboys trying to make up excuses? if you have something that operates by infrared dots on your face that supposedly works in dark or light how the fuck do you get confused by lighting conditions.

      Because optimally you should have good lighting conditions (IR and Visible light) and not obscure your face when training a facial recognition system which is what this couple did according to the article summary. Additionally if you wear something that obstructs the face you might also want to train your system while wearing said item. The FR gear is intended to recognise you under sub-optimal conditions based on a training data sets made under optimal conditions, it is not intended to be reliable if the training sample was created under atrocious conditions and you are doing recognition under atrocious conditions. In summary: Garbage data in, yields crappy recognition. What Apple should do is to ensure that only high quality training data sets are fed to the FR when it is being trained which could be done by adding code to the FR training app (or improve what existing code they have) that refuses to accept training data made under sub-optimal lighting conditions. So yes, this is an Apple's screw up but no this is by no means unexpected behaviour from a FR system. How bad the screw up is remains to be seen, this may be a problem fixable by software upgrade, if it is not and this is a hardware problem Apple can look forward to some major class action lawsuits. If you are a leader in technological feature development like Apple is, you have to take risks and sometimes you will fall on your face and this system qualifies as innovation since it is quite frankly the first serious attempt to add IR and 3D scan based FR to a mobile device. Falling on your face comes with the territory, you can either be on the cutting edge and innovate or you can play it safe and be ... average.

    2. Re:confused by lighting? by thegarbz · · Score: 1

      This may surprise you, but infrared radiation is very close in wavelength to this thing we perceive as "light", so much so that our "lights" in our house used to give of more of this mythical technology thing called "infrared" than actual light we perceived at one stage.

      If you think this interference means Apple is lying, I'm calling you ignorant. If you want to fix your ignorance look into the long history of using and sensing infrared in various fields, the history of TV remotes, IrDA, and even Nintendo's Duck Hunt as examples of technology which incorporates a lot of hacks to get around the fact that just because something senses IR doesn't mean it is immune from "light".

    3. Re:confused by lighting? by Narcocide · · Score: 1

      To be clear, I'm not defending Apple here; using this technology for authentication is a stupid gimmick and quite possibly criminally negligent, too.

      However, for an important key to understanding how ambient lighting could confuse the everliving fuck out of sensors based on reading IR dots, I have one word for you: candles.

    4. Re:confused by lighting? by AmiMoJo · · Score: 1

      Maybe it does work as they describe, but they had to turn down the % match limit to make it usable. People expect the phone to unlock quickly when they look at it, in all lighting conditions and from various angles. Although humans can't see IR, it is still there and able to interfere with the iPhone's weak IR projection.

      Say it measures the distance between your eyes. To do that it has to find the corners of your eyes, from various angles and various distances. The resolution of the sensor is limited so there has to be some tolerance. Set the tolerance too low and users struggle to unlock their phones, set it too high and family members can unlock it. Maybe there is no good setting that is both secure and convenient.

      All biometric sensors are the same.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    5. Re:confused by lighting? by JonnyCalcutta · · Score: 1

      "Confused by lighting" is just the politically correct way of saying that the device thinks "all you <insert race> look alike to me." X^D

      (Disclaimer: I have no idea what race the family in question, and I assume it's not stated anywhere.)

      Human, I think. The proper phrasing would be - "all you meatbags look alike to me"

    6. Re:confused by lighting? by sjames · · Score: 1

      You DO know that incandescent lighting is not so common these days, don't you? You might wanna update your knowledge if you're going to be calling people ignorant.

    7. Re:confused by lighting? by thegarbz · · Score: 1

      You DO know that incandescent lighting is not so common these days, don't you?

      It's still incredibly common even in countries where energy costs are double or triple that of the USA, to say nothing of the USA's energy price and the massive number of people who still think that energy efficient = expensive, will break, and OMG MERCURY WE'RE ALL GONNA DIE. It got to the point where they were actively litigating which resulted in a rush of orders before various different bulbs fell out of favour with the law.

      You might wanna update your knowledge if you're going to be calling people ignorant.

      Ironic. Pull the breaks a bit on your assumptions. There are some countries in the world where energy efficient lighting is the norm. But stating that incandescent lighting is not common is just outright wrong.

    8. Re:confused by lighting? by sjames · · Score: 1

      I live in the U.S. southeast and I can tell you that incandescent bulbs above 20W or so are not in demand. Most places that have them stock one or 2 packages only while they fill shelves with CF and LED bulbs.

      That in spite of the SE generally having cheaper power than the NE or West coast.

  22. Re:cue the apple fanboy by jellomizer · · Score: 1

    No this is a thread for the Android zealots.
    Because the iPhone X had very few problems compared to the other phones that came out around the same time. So we are finding a small number of cases where there are some problems and it is our thread to celibate that our phone that we have purchased for whatever reason we purchased was a good idea and those who didn’t make the same voice are now realizing how wrong they are to oppose your viewpoint.
    Or should the Apple Fanboys take a shot at finding all the problems with your phone. I am sure if theu dig down we will find a glitch or flaw to show how stupid we were for getting such a crappy phone and if we were willing to spend some extra money we would have a much better device.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  23. I've been sort of expecting this to happen by Lisandro · · Score: 5, Insightful

    Tim Cook's claim that FaceID is 20x more accurate than TouchID was kinda ridiculous. It is a neat technology and from what i hear it works well, but it is impossible to have face recognition that doesn't trigger false positives with relative ease. Telling people there's a one in a million chance that FaceID will mistake someone else face with yours is irresponsible.

    1. Re:I've been sort of expecting this to happen by jrumney · · Score: 5, Interesting

      One in a million basically means there are 7600 people who can unlock your phone just by looking at it. Due to the way evolution works, there is a good chance that some of those people are closely related to you.

    2. Re:I've been sort of expecting this to happen by pauljlucas · · Score: 1

      Due to the way evolution works, there is a good chance that some of those people are closely related to you.

      You mean genetics, not evolution.

      --
      If you reply, do so only to what I explicitly wrote. If I didn't write it, don't assume or infer it.
  24. Re:And this is why I want a fingerprint scanner .. by richy+freeway · · Score: 1

    So you type on your phone with it laying flat on the desk?

    Again this is something that just feels unnatural to me, nearly always hold my phone while typing with one hand.

  25. Yes, but by Traf-O-Data-Hater · · Score: 1

    "one-in-a-million chances crop up nine times out of ten."
    --Terry Pratchett

  26. You are holding it wrong by houghi · · Score: 5, Funny

    Apple officials said "You are holding it wrong, in this case in front of the wrong person."

    --
    Don't fight for your country, if your country does not fight for you.
  27. Re:And this is why I want a fingerprint scanner .. by Dog-Cow · · Score: 1

    Because tapping your unlock code was even more work? Or is Android so fucked-up that you had one option or the other, but not both?

  28. Apple has already explained this by Fredde87 · · Score: 2

    There has been numerous articles like this now. Apple has already explained that Face ID stores info about a persons face once a successful PIN code is entered to keep up with the users appearance over time. So whats most likely happened again is that the parents give their phones to their kids to try, the Face ID scan first fails and when the parents then put in the correct PIN code the phone stores information about the kids face together with the parents until eventually it learns to accept the kids face too. Read more here, https://www.theverge.com/2017/...

    1. Re:Apple has already explained this by coofercat · · Score: 1

      So it's broken, but they've explained so it's okay?

      If I enter my pin code, it's just what it is. It doesn't magically transmogrify into allowing a different pin code. No explanation needed by vendor - it's pretty much 'a given'.

  29. $1000 Paternity Test by BirdBrained · · Score: 5, Funny

    If your kid can't unlock your iPhone X, maybe you should have a little chat with your wife.

  30. Hilarious? by nospam007 · · Score: 1

    At least the boy now knows, that the mailman ain't his father.

  31. Re:So what? by hyades1 · · Score: 2

    "Anything else you might as well leave your phone unlocked or put a cheap pin on it so that your girlfriend isn't able to view your browser history."

    When you've been on Slashdot for more than 10 years, do you get to have a girlfriend?

    --
    I've calculated my velocity with such exquisite precision that I have no idea where I am.
  32. His son and the rest of us by sad_ · · Score: 1

    And his son just "thought it was hilarious."

    well, not only his son, i think it is hilarious as well.

    --
    On a long enough timeline, the survival rate for everyone drops to zero.
  33. Re:cue the apple fanboy by Paradise+Pete · · Score: 4, Insightful

    My wife asks me to do things on her phone all the time while she's driving, so she can keep her eyes on the road. I know her passcode so I can do these things, and FaceID tries to scan every time the screen is turned on. That means, intentional or not, if she had an iPhone X with FaceID enabled, I'd be training it to recognize my face every single time I unlocked it using the passcode. Eventually, we'd both be able to unlock it.

    This is true only if you are a close match to begin with. When a Face ID authentication fails, but is within a small failure threshold, and then the passcode is entered, another measurement is taken for training. The purpose of this is to learn as the face subtly changes, as they do. But if you and your wife are already a close match , and you know and enter the passcode, then it will augment its training from your face.

    If you don't know or don't enter the passcode then no training is done.

    So yes, this is definitely one more problem (among many) for Apple to solve, but it's not the huge security hole some are making it out to be. For me it's a tremendous convenience and reasonably safe, but if were in a situation where I was truly worried about security then I would disable it.

  34. Re:And this is why I want a fingerprint scanner .. by mark_reh · · Score: 1

    as long as you don't have a case on the phone.

  35. Re: Embarrasment? by Zero__Kelvin · · Score: 1

    If you have to ask that then you have squandered your time on this planet.

    --
    Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  36. Re: cue the apple fanboy by Zero__Kelvin · · Score: 1

    Kernel or user space makes no difference. Attempt to sound smart: EPIC_FAIL

    --
    Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  37. Locked? by Bruinwar · · Score: 2

    I got a new phone a couple months ago & I've still not got around to locking it. I don't have Android pay or whatever set up (these things will make you set up a password). So what? If I lose it or it gets stolen, I call the provider & get the service shut off. It's sure is convenient to use right now. Am I missing something here?

    --
    SLOWER TRAFFIC KEEP RIGHT
    1. Re:Locked? by coofercat · · Score: 1

      ...not so cool when you've used the browser to authenticate with Google, and you've logged in the facebook app, and you've connected up your email to the email app.

      If you're never going to do those things, then yeah, don't bother with the lock. In fact, sell your phone and buy one of those cheap Nokias, as it'll do 90% of what you use your smart phone for, but at a fraction of the cost.

      The point is, for calls and texts, yes, your provider can stop that service. For anything else, they can't do that for you, and so those services continue to work with the phone in someone else's hands. Even changing the password on a lot of Internet services won't actually log any existing users out, so until they hit the 2 week re-authentication timeout, they're doing what the hell they like with your accounts.

    2. Re:Locked? by Anonymous Coward · · Score: 2, Informative

      Really depends what you use it for. If you only ever make calls, then you're only risking your phone book. That might not seem like a big deal, but phoning up a mark's relatives pretending that there's some urgent crisis (broken down car in the middle of nowhere, been mugged in an unfamiliar city, had a serious accident and in hospital outside your network etc) and that they need to wire money/provide details/etc is very common scam.

      If you send or recieve messages, then you're risking your message history, including any confidential or private correspondence you might have sent (e.g. my bank sends me notifications for transactions that are quite handy for me, but would be very helpful to fraudsters trying to impersonate me).

      If you use mobile web you're risking any passwords you have saved to the device and any data contained within those accounts.

      If you take pictures, then you risk having them misused. Even innocuous images have embedded GPS data that could allow a thief to work out where you live and work. That's if the phone itself isn't linked to a google account that will cheerfully provide a map and schedule.

      Basically, if you actually use your phone for anything it's an absolute goldmine for fraudsters. A casual thief probably won't be interested in that, but they will have no problem fencing it to someone who is. And if they are smart, disabling or remote wiping it after the fact won't help; thieves tend to turn phones off so they don't get tracked, and the next time it's turned on it'll be somewhere with no signal so the data can be safely lifted.

    3. Re:Locked? by Bruinwar · · Score: 1

      No Facebook app but Google could be a problem. If they were quick & got into it before I shut it off, they could possibly change my google account password & cause me grief. Once the service is off, no internet, correct? I can't get my old S5 to connect via WiFi without service. Verizon requires a data plan to use the Internet at all. It wouldn't surprise me if there was a way to get it to work, but I've never gave it much effort.

      Not that I disagree. I locked my phone. Fucking fingerprint reader on the back really sucks.

      --
      SLOWER TRAFFIC KEEP RIGHT
    4. Re:Locked? by swillden · · Score: 1

      Am I missing something here?

      Depends on whether you have any data on the phone that you'd like to protect. Even if you only use it to make calls, you still have your call log and perhaps some contacts on there. A good social engineer can create lots of trouble with that information.

      Basically, you need to think about everything that's on the phone, and how it could be used to steal from you. Think especially about remote services that your phone has access to. Then decide if you should lock it.

      I think the vast majority of people should lock their phones, but that they don't actually need really strong authentication. Fingerprint is a very good choice for most. Convenient and reasonably secure. The jury is still out on whether face can be made sufficiently secure.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    5. Re:Locked? by Actually,+I+do+RTFA · · Score: 1

      I think Google cheerfully providing a map and schedule is more a problem with the data you let Google amass on you than the access a thief might get.

      --
      Your ad here. Ask me how!
  38. Missing the point by sjbe · · Score: 5, Informative

    Think TouchID or FaceID like a lock on your front door. Yes it can be hacked and bypassed. Sometimes in ways you might not expect. It's low grade security. But that isn't the point. The point is to keep out the majority of less determined individuals out while being a reasonable balance between security and convenience for typical usage. If you want greater security there are features (passwords, etc) you can utilize to strengthen the system. Most of the time these are overkill but sometimes they are a very good idea. Anyone expecting TouchID or FaceID to provide iron clad security has incorrect ideas about what they are for and what their limitations are.

    1. Re:Missing the point by hyades1 · · Score: 2

      My mistake. I thought the point was so a cop could shove it in your face and have it unlock itself for him.

      --
      I've calculated my velocity with such exquisite precision that I have no idea where I am.
    2. Re:Missing the point by sjbe · · Score: 1

      My mistake. I thought the point was so a cop could shove it in your face and have it unlock itself for him.

      Make the password required and it's a non-issue.

    3. Re:Missing the point by Lisandro · · Score: 2

      Anyone expecting TouchID or FaceID to provide iron clad security has incorrect ideas about what they are for and what their limitations are.

      Apple seems to do. ApplePay, for example, is authorized by FaceID by default.

    4. Re:Missing the point by iggymanz · · Score: 1

      you're missing the point, biometrics for secure access in 2017 is a farce yet it is touted as being sufficient to protect your payments, a nuke plant, etc.

      low grade security indeed, but high grade uses are made

    5. Re:Missing the point by Miles_O'Toole · · Score: 2

      If you're going to make the password required anyway, why bother with this nonsense...so you can gaze longingly at Siri, and have her ask you for your password?

      --
      Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.
    6. Re:Missing the point by swillden · · Score: 1

      Anyone expecting TouchID or FaceID to provide iron clad security has incorrect ideas about what they are for and what their limitations are.

      Apple seems to do. ApplePay, for example, is authorized by FaceID by default.

      Why do you think ApplePay requires "iron clad security"? Remember it only has to be better than a magnetic stripe card.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  39. Re:Picture by Narcocide · · Score: 1

    It's probably worth trying independently, but supposedly the sensor is capable of depth-mapping so the child would still have to paste a printout of the family portrait onto similarly shaped mannequin head or cardboard frame of some sort.

  40. Re:One in a million by Narcocide · · Score: 1

    Lots of conventional light sources also give off IR. Many of the historically more common ones actually give off more IR than visible light. If the software isn't as smart as they claim, I could see how the lights themselves could be confused for part of the sensor's own dot pattern, and possibly lower the accuracy of the reading. I could have told them this myself, but I doubt they would have listened. What really surprises me is the thought that maybe Apple didn't even bother to hire someone who understood light to review this technology.

  41. Got issues? by sjbe · · Score: 5, Insightful

    I've been completely blackballed throughout entire corporations just because of the brand of mouse I chose to buy, or the fact I refuse to use Facebook.

    Oh bullshit. No corporation will give a shit about what brand of mouse you use unless you are a flaming asshat about it or somehow manage to violate their corporate IT rules. I don't use Facebook either and I have yet to run into a corporation that gives a shit about that even a little bit. Even if what you say is true that sounds like it is you that is the issue.

    If you can't imagine anything in your phone (or not in it, for that matter) that anyone would take offense to, I suggest you either must not use it or you're just really naive.

    If you work in a workplace that is THAT hypersensitive then I suggest you find a new and better employer. I can confidently say that there is absolutely nothing on or missing from my phone that I'm even a little worried about my coworkers getting offended over. That would be equally true of every employer I've ever worked for which at my age is quite a few of them. I would have some concerns about them getting access to some banking and financial info but that is the worst of it. Nothing there I'm the least bit embarrassed about including the contents of my emails and correspondence. I'm concerned about serious things like identity theft. That's not to say some people don't have some personal things they need to hide sometimes but if access to your phone is a concern then I suggest you keep such data off your phone.

    Big companies generally devolve into popularity contests.

    If you think that then I think you have serious social issues that no one here can help you with.

    1. Re:Got issues? by Narcocide · · Score: 2

      I would have some concerns about them getting access to some banking and financial info...

      Careful there, you're dangerously close to noticing a crack in your own logical facade.

    2. Re:Got issues? by Maxwell'sSilverLART · · Score: 4, Interesting

      I've been completely blackballed throughout entire corporations just because of the brand of mouse I chose to buy, or the fact I refuse to use Facebook.

      Oh bullshit. No corporation will give a shit about what brand of mouse you use unless you are a flaming asshat about it or somehow manage to violate their corporate IT rules.

      When I worked at Dell, our director made me get rid of my IBM Model M.

      --
      Moderate drunk! It's more fun that way!
    3. Re:Got issues? by sjbe · · Score: 1

      Careful there, you're dangerously close to noticing a crack in your own logical facade.

      Nothing embarrassing about my financial info. There are reasons to worry about security but embarrassment shouldn't be one of them. Safety of physical person or assets is a reasonable argument. Embarrassment is not. If you have something embarrassing on your phone perhaps you should consider removing it from the phone.

    4. Re:Got issues? by TheFakeTimCook · · Score: 1

      That's because you were annoying the shit out of everyone around when you typed ;)

      Around him, hell! He was annoying the shit out of everyone in the next COUNTY with that thing!

    5. Re:Got issues? by freeze128 · · Score: 1

      ...or maybe it was the fact that the Model M had an AT connector, and Dell was no longer using 286 desktops...

    6. Re:Got issues? by PRMan · · Score: 1

      That's because he got tired of having a clackity-clack headache every day.

      --
      Peter predicted that you would "deliberately forget" creation 2000 years ago...
  42. I knew Picassa was confused like this. by 140Mandak262Jamuna · · Score: 2
    I had more than 50,000 snaps of family members and friends and relatives because when the digital cameras came along I became a obsessed shutter bug. When Picassa debuted face recognition I saw it as a boon to organize my photo collection.

    Very quickly I discovered it confused mothers with daughters. When our turn to host the pot-luck comes around, our guests used to gather around, let Picassa lose on the collection and laugh and marvel at the same time about its confusion.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:I knew Picassa was confused like this. by pedz · · Score: 1

      Adobe's Lightroom also has "face recognition" and its nearly useless. BUT... I thought the Apple face id scanned your face and created a 3D map so I had hopes.

  43. I'm confused... by squash_me_quickly · · Score: 2

    Did anyone really expect this to be more than a modern "keypad lock"?

    On my first phone, one could lock and unlock the keypad by pressing 0000. This was not security measure, just a way of preventing accidental phone calls.

    Face ID is just the modern "keypad lock", the right photo of the person will probably also unlock the phone.

  44. Re:And this is why I want a fingerprint scanner .. by richy+freeway · · Score: 1

    Bizarre as this may seem, the manufacturer of the case I use saw fit to include a cutout for the fingerprint reader.

  45. Re:cue the apple fanboy by Anonymous Coward · · Score: 1

    I see what you did there "relative ease."

  46. What a surprise by OneHundredAndTen · · Score: 1

    Once again, biometrics showing that they are an almost empty shell.

    1. Re:What a surprise by Baron_Yam · · Score: 1

      Well, if you add 'currently practical' to that, yes.

      However, human faces are unique and very little is required for recognition - as long as the recognition engine is a human brain familiar with the subject. Eventually we should be able to mimic that with a computer algorithm.

      Using facial recognition on an iPhone at this point, though, was an ill-conceived marketing ploy. It's simply still too easy to fool.

  47. It's a new paternity test.. by sqorbit · · Score: 1

    Look at my phone. It Unlocked! You are the father!

    --
    Sent from my TARDIS
  48. Re: Embarrasment? by Zero__Kelvin · · Score: 1

    It's pretty sad that you have no life, as evidenced by the fact that you think that the only thing you would not want them to know about is copulation with co-workers.

    --
    Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  49. Thank you, Apple, for answering that old question: by Miles_O'Toole · · Score: 1

    Are you my Daddy?

    --
    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.
  50. Re:cue the apple fanboy by mjwx · · Score: 2

    No this is a thread for the Android zealots.

    Why would we care?

    Face Unlock on Android was broken years ago. Its taken this long for the iSnore to catch up *yawns*.

    --
    Calling someone a "hater" only means you can not rationally rebut their argument.
  51. And thus was born another chapter in the story of. by Lord+Kano · · Score: 1

    "Which parent does little Ammar look more like?"

    LK

    --
    "Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
  52. Re:And this is why I want a fingerprint scanner .. by mark-t · · Score: 1

    Of course, but legally you can, without anything special happening, be compelled to surrender your fingerprints to authorities for any investigation that they deem appropriate, even if you have not been personally convicted of any crime, or even if no crime has actually even occurred. Legally compelling you to surrender your pass code requires going to court first, where you at least have a chance of having a sympathetic judge.

  53. Re: Embarrasment? by TheCastro1689 · · Score: 1

    We've seen on /. tons of examples of people losing their jobs over their opinions and activities. So it seems like there's a few things outside of work that can cost you your job if someone at the job doesn't like what you do outside of work.

  54. Brand loyalty by sjbe · · Score: 1, Troll

    When I worked at Dell, our director made me get rid of my IBM Model M.

    Given that Dell sells Dell branded keyboards that's hardly shocking. It's reasonable for companies to like their employees to show some brand loyalty for products they use on the job.

  55. Re:And this is why I want a fingerprint scanner .. by mark-t · · Score: 1

    As you need to press the home button on the front to awaken the device in the first place, what is the difference between doing that and having the fingerprint recognizer there?

  56. Re:DuckDuckGo is CENSORING search results. by mark-t · · Score: 1

    How in the world can DuckDuckGo plausibly claim not to track you when they have a settings system that persists between visits?

  57. Arya!? by kiviQr · · Score: 1

    10y old boy ... aka. Arya Stark?

  58. Re:And this is why I want a fingerprint scanner .. by richy+freeway · · Score: 1

    I don't have to press anything on the front of the device to wake it up, I just put my finger on the fingerprint reader and it unlocks and wakes up.

  59. Re: cue the apple fanboy by mark-t · · Score: 1

    So, to crack the phone, one would have to disable auto-deletion of data due to failed attempts. To do this, a security research group would need to dissolve the casing of a single CPU....

    The solution to that is obvious.... implement a light-sensor switch in the hardware that considers any opening of the case, unless it has previously been expressly authorized, to be equivalent to having failed to enter the correct password after whatever limited number of failed attempts are defined before auto-deletion.

  60. Re:And this is why I want a fingerprint scanner .. by mark-t · · Score: 1

    I was under the impression that we were talking about iphones here... which still need to be woken up to use, even if you don't have fingerprint detection on.

    Is your objection that Apple has put the home button on the front of the device in the first place?

  61. Re:cue the apple fanboy by BronsCon · · Score: 1

    This is true only if you are a close match to begin with.

    Got a cation for this, other than the same marketing wank that incorrectly claimed this would only be a problem for twins and kids under 13?

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  62. Re:And this is why I want a fingerprint scanner .. by richy+freeway · · Score: 1

    No they can do what they like! :) I don't own an iPhone for various reasons, one of which being the fingerprint reader is on the front.

    To each their own though. That's the best bit about a diverse choice of phones, there's something for everyone. Nexus 5x here and I couldn't be happier with it.

  63. Re:cue the apple fanboy by Gr8Apes · · Score: 1

    My wife asks me to do things on her phone all the time while she's driving, so she can keep her eyes on the road. I know her passcode so I can do these things, and FaceID tries to scan every time the screen is turned on. That means, intentional or not, if she had an iPhone X with FaceID enabled, I'd be training it to recognize my face every single time I unlocked it using the passcode. Eventually, we'd both be able to unlock it.

    One of the problems with the iphone (and Android too) is that it assumes only 1 person will ever unlock it. That can be proven false by merely looking at just about any married couple. You stand as 1 example, I'm a second, and I'm sure there are many many others. In addition, I happen to have an app that allows for multiple users on a single device. The hoops you have to jump through to make that happen are not minor, because the entire phone premise runs along the same lines as DOS/Windows/OS2 (Windows pre NT) There just is no functional multi-user support in phones.

    --
    The cesspool just got a check and balance.
  64. problem with statistical representations by j2.718ff · · Score: 1

    Apple claims that the odds of someone being able to unlock your phone with their face is 1 in 1,000,000. That sounds impressive, but with 7.6 billion people in the world, that means there are 7,600 people who can probably unlock your phone. But where do those people probably live? They most likely aren't randomly shuffled throughout the world. They are most likely the people with the same facial features as you - with similar ethnic backgrounds, and very likely, in similar geographic locations. I certainly look similar to the people around me. And I look particular similar to members of my family. I wonder if it would be very difficult for me to intentionally find someone who could unlock the same phone as me.

  65. Re:cue the apple fanboy by BronsCon · · Score: 1

    Android does have the concept of multiple users, and has for a couple major versions at least (I don't recall when I first saw it -- and I've never used it beyond testing it once to see how it functioned) but it really wouldn't help in this instance, anyway. Each user has their own set of accounts and their own storage, so I couldn't ask my wife to, for example, sign in to my phone with her PIN or passcode and check my gmail, as my gmail would be assigned to my user; she'd still need my PIN or passcode for that.

    IMO, that make the feature nearly useless (thus why most people don't even seem to know it exists) on a phone, as very few people share a single smartphone, and those who do probably also share accounts. The only legitimate use case I see for this is a half-assed implementation of Kid Mode, and we already have Kid Mode, so... why implement this the way it was implemented?

    I mean, I suppose I could give my wife a user account on my phone and set up my gmail and messages and whatnot on it that I might want her to have access to at times, but then I'm storing two copies of everything in already-limited storage and she still can't unlock the phone to change playlists in Pandora without triggering a logout due to multiple logins, as the app would be running under my user.

    At least Android gives me that option, though. Where's Apple's implementation? I expect someone to posit that they don't have one because they havne't figured out how to do it right and I expect to agree with whoever says that, if only because I don't believe there is a "right" way to implement multiple user accounts on a phone.

    A guest PIN/passcode which allows restricted access to only a subset of apps, features, data, and settings would be ideal on both platforms. Let's wait and see who implements it first. My bet? Neither of them, it would simply be too useful (and cut down on purchases made by kids who no longer have mommy's passcode).

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  66. Re:Biometrics are very insecure by stooo · · Score: 1

    >> Fingerprints seem to be pretty good in the real world. The FBI can't seem to crack them. UK security forces can't reliably crack them
    That's wrong.
    Fingerprints can be reproduced in so many ways it's not even funny.
    - from a photo of your fingers 10m away
    - from the fingerprints registered in your ID card (depends on your country)
    - from the fingerprint you leave on every smooth object you touch, like for example, your smartphone screen

    --
    aaaaaaa
  67. Re:cue the apple fanboy by TheFakeTimCook · · Score: 1

    The "learning" aspect of FaceID is its primary weakness. There are solutions, of course, and a proper implementation would apply them.

    I think you might be right about the "learning" aspect being an unexpected weak point of FaceID.

    I also like your idea of the "Guest Passcode", that wouldn't trigger the "Relearn", but that would let the Guest have limited access to run Safari and Maps, and whatever else the owner wishes to grant access to in Settings.

    Fortunately, that is something that is relatively easy to fix in software... Hopefully!

  68. Re:cue the apple fanboy by TheFakeTimCook · · Score: 1

    iPhones are internally very secure--it's pretty much impossible to crack a locked iPhone with a proper passcode, unless you introduce one of these easy defeat mechanisms into the mix. A gift to the government, perhaps?

    No, it's called "We HAVE to get this thing OUT THE DOOR... NOW!"

    Not an excuse; but a much more realistic reason that some sort of collusion with the gummint.

  69. Re: cue the apple fanboy by TheFakeTimCook · · Score: 1

    Fuck you. It isn't an either/or. You don't need to 'love' your Android phone to despise Apple and their army of little zealots.

    You should talk, member of the Army of ANONYMOUS COWARD Apple Haters.

  70. Re:cue the apple fanboy by TheFakeTimCook · · Score: 1

    Why would we care?

    I don't know; but you so OBVIOUSLY, er, DO.

    Jealousy, perhaps? That is the only rational explanation.

  71. Re: cue the apple fanboy by TheFakeTimCook · · Score: 1

    I would love to see how FaceId works for people who wear damn near theater makeup every day.

    Quite well; since it doesn't use color as part of the identification.

  72. Re:cue the apple fanboy by BronsCon · · Score: 1

    The FaceID debacle (if one wishes to call it that -- it may be a bit extreme of a term) might be what pushes them to finally implement a guest passcode; and Apple implementing it might be what triggers Android to do it. If that happens, an absolutely huge number of people will be thankful for FaceID, whether they know it or not, even if they don't have an iPhone X.

    We can hope and dream, right?

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  73. Re:cue the apple fanboy by Gr8Apes · · Score: 1

    Android does have the concept of multiple users, and has for a couple major versions at least (I don't recall when I first saw it -- and I've never used it beyond testing it once to see how it functioned) but it really wouldn't help in this instance, anyway. Each user has their own set of accounts and their own storage, so I couldn't ask my wife to, for example, sign in to my phone with her PIN or passcode and check my gmail, as my gmail would be assigned to my user; she'd still need my PIN or passcode for that.

    Note I said "no functional multi-user support". I am aware Android has the base concept of multi-user built in, but IIRC that only "works" for a small subset of devices, mostly tablets, again, IIRC.

    IMO, that make the feature nearly useless (thus why most people don't even seem to know it exists) on a phone, as very few people share a single smartphone, and those who do probably also share accounts. The only legitimate use case I see for this is a half-assed implementation of Kid Mode, and we already have Kid Mode, so... why implement this the way it was implemented?

    Exactly my point regarding the implementation - it basically required me to code all aspects of multi-user into the apps I support, all the way down to basic permissions. It also requires the devices to be configured in a certain way. Managing it is now easy, but it was painful to get here.

    At least Android gives me that option, though. Where's Apple's implementation? I expect someone to posit that they don't have one because they havne't figured out how to do it right and I expect to agree with whoever says that, if only because I don't believe there is a "right" way to implement multiple user accounts on a phone.

    Apple's "implementation" is even more painful - you can do a multi-user configuration via 100% manual configuration starting with logging yourself out of icloud etc and logging in a second user. To say it is onerous is like saying all you need to be president is a little money an half an opinion.

    A guest PIN/passcode which allows restricted access to only a subset of apps, features, data, and settings would be ideal on both platforms. Let's wait and see who implements it first. My bet? Neither of them, it would simply be too useful (and cut down on purchases made by kids who no longer have mommy's passcode).

    I agree with you that that would be perfect - it's akin to the admin/user/guest concepts, with ever lower permissions and access. What kills me is that Apple allows you to respond to a text on the lock screen. No security needed. By default. And there's a host of other interesting choices they made under the guise of idiot usability.

    --
    The cesspool just got a check and balance.
  74. Re:DuckDuckGo is CENSORING search results. by mark-t · · Score: 1

    Sure, but you could do the same thing with google or any search engine.

  75. Re:cue the apple fanboy by Paradise+Pete · · Score: 1

    Got a cation for this, other than the same marketing wank that incorrectly claimed this would only be a problem for twins and kids under 13?

    If you're going to exclude Apple's own statements then how could I possibly have a citation? So instead apply some logic. If it weren't true then the cases of false positives would be rampant.

  76. Re:cue the apple fanboy by BronsCon · · Score: 1

    What kills me is that Apple allows you to respond to a text on the lock screen. No security needed. By default.

    Not that I did not know! I don't sift through my wife's messages, nor do I text from my iPad, so I'd likely never have learned that had you not just said it. That's... scary. I mean, I have the option with Android, as well, but it's certainly not the default, at least on any device I've ever owned.

    I really want to like iOS, but...

    there's a host of other interesting choices they made under the guise of idiot usability.

    Well, you know why I don't.

    I recognize that Android isn't a whole hell of a lot better, but if I have to choose between an insecure system that appears to work the way I want it to (Android) and an insecure system that tries to alter my behavior (iOS), I'm choosing the one that at least pretends to do what I want. My wife's the same way; it's just that iOS happens to work more like what she wants, so that's what she uses. Even she sees what's wrong with the last 3 generations of iPhone, though, and I haven't even been able to get her to look at an iPhone X.

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  77. Re:cue the apple fanboy by BronsCon · · Score: 1

    If you're going to exclude Apple's own statements then how could I possibly have a citation?

    Of course I'm going to exclude statements which have been categorically proven false. You could cite someone having actually tested it. Thus far, every time I've seen it tested, failed unlock, enter PIN, next unlock is successful, regardless of how similar or dissimilar the two people happen to be.

    So instead apply some logic.

    Yes. Let's.

    If it weren't true then the cases of false positives would be rampant.

    Only among users who happen to enter the correct PIN after a failed face unlock, thereby triggering the learning process.

    And, well, guess what: it's pretty damn rampant among those users.

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  78. Re:cue the apple fanboy by BronsCon · · Score: 1

    Oh wow, nice catch. That was actually unintentional.

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  79. Re:cue the apple fanboy by TheFakeTimCook · · Score: 1

    The FaceID debacle (if one wishes to call it that -- it may be a bit extreme of a term) might be what pushes them to finally implement a guest passcode; and Apple implementing it might be what triggers Android to do it. If that happens, an absolutely huge number of people will be thankful for FaceID, whether they know it or not, even if they don't have an iPhone X.

    We can hope and dream, right?

    I have no dreams for Android; but you're right.

  80. Re:cue the apple fanboy by Gr8Apes · · Score: 1

    I really want to like iOS, but...

    there's a host of other interesting choices they made under the guise of idiot usability.

    Well, you know why I don't.

    I do spend about 15-20 min when I get a phone to set it up the way I want. With iOS 11 that has unfortunately not been 100% possible (I'd love to turn off those stupid control animations across the board - I want to get to where I need to be, not wait on a damn key highlight animation)

    I recognize that Android isn't a whole hell of a lot better, but if I have to choose between an insecure system that appears to work the way I want it to (Android) and an insecure system that tries to alter my behavior (iOS), I'm choosing the one that at least pretends to do what I want.

    Among my many issues with Android, besides being insecure, is it's utter lack of consistency across versions, devices and vendors. This isn't merely a statement about a minor GUI thing, but more along the lines of being inconsistent the way Microsoft was between Win7->Win8->Win10. Each one varied and changed things underneath, and not for the better. I feel Android is like that, but cubed in its impact. iOS is better, but not enough to say it's "better" outright. There are things they've done under the covers that are absolutely ridiculous but most people never notice. After all, it's more stable in general than Android, even through Marshmallow. But Android is getting better. Slowly.

    --
    The cesspool just got a check and balance.
  81. Re:cue the apple fanboy by Paradise+Pete · · Score: 1

    And, well, guess what: it's pretty damn rampant among those users.

    It is? How many cases do you know of? If that true I'd like to know about it. That would change my view.

  82. Re:cue the apple fanboy by BronsCon · · Score: 1

    I'm not out to wage war against the iPhone X so I haven't been compiling a comprehensive list. You can find the examples pretty easily on YouTube, though; if you truly care to be enlightened, you must put forth some of the effort yourself. If I do it for you, it just comes of as an attack on Apple and, well, that's just silly.

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  83. When The Kid Compiles a JB, by Lord+Flipper · · Score: 1

    ...let me know.