Slashdot Mirror
In a Test, 3D Model of a Head Was Able To Fool Facial Recognition System of Several Popular Android Smartphones (forbes.com)
Forbes magazine tested four of the most popular handsets running Google's operating systems and Apple's iPhone to see how easy it'd be to break into them with a 3D-printed head. All of the Android handsets opened with the fake. Apple's phone, however, was impenetrable. From the report: For our tests, we used my own real-life head to register for facial recognition across five phones. An iPhone X and four Android devices: an LG G7 Linq, a Samsung S9, a Samsung Note 8 and a OnePlus 6. I then held up my fake head to the devices to see if the device would unlock. For all four Android phones, the spoof face was able to open the phone, though with differing degrees of ease. The iPhone X was the only one to never be fooled.
There were some disparities between the Android devices' security against the hack. For instance, when first turning on a brand new G7 Linq, LG actually warns the user against turning facial recognition on at all. No surprise then that, on initial testing, the 3D-printed head opened it straightaway. [...] The OnePlus 6 came with neither the warnings of the other Android phones nor the choice of slower but more secure recognition.
There were some disparities between the Android devices' security against the hack. For instance, when first turning on a brand new G7 Linq, LG actually warns the user against turning facial recognition on at all. No surprise then that, on initial testing, the 3D-printed head opened it straightaway. [...] The OnePlus 6 came with neither the warnings of the other Android phones nor the choice of slower but more secure recognition.
is that not a bit retro? in `mission impossible' they had rubber masks which pretty much fool everybody .... not just dumb smartphones.
You can't replace your fingerprints, iris, or head once they are compromised which happens about every 10 minutes these days.
IOW most if not all biometric authentication systems suck unless they are coupled with old boring passwords. You leave your fingerprints on everything you touch. Your face and retina can be remotely scanned, saved and duplicated. This leaves us with brainwaves but I'm not entirely sure they can't be copied as well. But you can be sure as hell brainwaves authentication will be incredibly difficult and expensive to implement for smartphone security.
Why weren't they able to crack Apple FaceID? Maybe because their 3D printer wasn't good enough as FaceID scans over 30 000 spatial dots in order to verify your identity but there were reports that it's already been cracked.
Thank you for pointing this out, again.
I'm sure a 4 digit code smeared on the display is a lot safer.
That is the alternative security measure for most people and thus most phones.
Biometrics that are hard to spoof within the 4 tries an adverary has before the device falls back to a 6+ character alphanumeric code are just brilliant and way more secure in real life.
Is that possible?
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
I have a laptop with "Windows Hello", which is a terrible name for their version of FaceID. It actually works very well after going through some sort of machine learning curve. My phone is too old to have such a feature, but my wife liked it enough to ask if we could do it with the webcam on the desktop. No-go there without a new webcam, as only some support it. I looked into it only briefly, but I believe in addition to some security features, it used infrared or similar spectrum to ensure it was looking at a real face and not a simulacrum. I would imagine that Apple may be doing something similar with their hardware.
If someone has a 3d printed copy of my head, they could unlock my phone and call people that I know.
No mobile phone is secure. Don't do things on a mobile phone that you want to keep secret.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Especially if you've been handing out high-quality 3D replicas of your head, don't use facial recognition and expect it to be secure.
But yeah pretty much don't expect any technology made after about 1850 to be secure. If you're a spy, a piece of paper and a one time pad might be the way to go.
Nazi homosexual recruiter RAY MORRIS pushing debunked Nazi propaganda even after corrected, #ROPE
Did Apple ever fix the âoeidentical Chineseâ Face ID problem?
Considering that humans could quite possibly be fooled by a 3D printed head in similar conditions, I'm actually very impressed they weren't all cracked. I also think this is an edge case scenario- Your phone is taken by someone who has the data, resources, and the will to make a 3D model of your head just to open it. Usually people would point to the government as a possible culprit here, but the government doesn't need to go to these lengths, they can use your actual face.
Inverting reality is the weakest form of trolling. Up your game.
I wonder about the facial recognition built in to the Microsoft surface devices.
Biometrics shouldn't be used as an unlock key in the first place. As others have noted, keys can be (and are constantly being) compromised.
Biometrics might be a suitable substitute for the logon ID, but should never be used as a substitute for a password.
Right. The smartest ones are those that pay 3x more to have the same technology, but with a fruit figure etched into its frame.
When ISIS chops your head off for being infidel, can it be used to unlock your phone?
Right. The smartest ones are those that pay 3x more to have the same technology, but with a fruit figure etched into its frame.
The irony of your comment is lost on you, isn't it? Especially considering the content of the article on which you're commenting.
Yes, what matters is that it's not from Apple, who cares if the shit actually works?
Physical security shouldn't be taken lightly. Keep your hands on your stuff.
At least in the US, yes, the 4 digit PIN smeared all over your device is a lot safer.
What a hilarious gaffe you made repeating the very statement that proves you wrong!
You see, that 4 digit PIN has been declared to be protected
That protects you legally from having to reveal your passcode...
However if you think back to that sentence you copied, they know from the smears on the screen the digits of your passcode. Making it very likely they could simply guess it.
With an iPhone, if you see them holding a phone up to your face, you can simply refuse to unlock it by shutting your eyes. And if you are going through an area where you think they might try at all, you can always tell the iPhone to go into passcode only mode.
The rest of the time you get the convenience of FaceID, along with the extra security of not having to type your passcode out repeatedly in front of who knows how many cameras....
Didn't think about that one, did ya?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
But at least on the oneplus, the face unlock is just for the screen unlock, it's not for anything else. Not good for google pay, for banking apps, etc. Apple face ID is tighter, because they don't have fingerprint sensor anymore.
I also think this is an edge case scenario- Your phone is taken by someone who has the data, resources, and the will to make a 3D model of your head
Not shown: How many of the same phones are also opened by a printout of the face.
Doesn't take many resources to take a picture of someone's face and print it out...
That's because a lot of the Android phones that use facial recognition are doing so from a single camera with no depth map, the way the iPhone works.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Interesting, but this isn't the first 3D printed body part to convincingly mimic the real thing.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Wasn't a troll. I can't stand Apple myself but they're the lesser of two evils when it comes to smartphones - I would never trust my data and privacy to the Android platform.
A company obsessed with a completely closed platform and total ownership of that platform is never the lesser of two evils.
That said, if you are already using a smartphone connected to a carrier it's a little late to pretend the security of your data and privacy are important to you. You already sold them for convenience. At that point the questions are how many Johns; do you speak greek; what are your rates; and about just a little metadata?
The next step is you attach a device to the phone which has independent displays feeding each camera.
After you calibrate the signal, you can pass you can pass your AR world with a dynamic fake head, that blinks and moves.
Should be closer to reality and you don't have to carry around a fake head to unlock your phone ...
I guess for security, you could use such a device to increase security, by using a fake head model that is not your own or even real. Perhaps Luke Skywalker with bunny ears.
Perhaps a randomly generated head/face...
Perhaps a horse head combined with a stapler.
Yes, turning face recognition into a holographic password. Probably not really practical or useful.
Yep, and none of this will stop the police from holding your skull in place
Even if they do that as long as your eyes are closed it won't unlock the phone.
Especially if you saw there might be an issue and tapped the power button five times, which makes all iPhones require a passcode to unlock instead of biometrics...
Apple is the only one with a truly secure approach, in public view use biometrics to unlock your device, instead of using your password in public in view of many cameras. Then when entering secure zones with risk of phone examination, switch to passcode only until you are through.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Who would ever think that all the methods that have continually worked over and over to defeat biometric methods would continue to work?
P.S.: Train your data sets with reality, not with artificial segments of reality.
-- Tigger warning: This post may contain tiggers! --
THERE WILL BE CONSEQUENCES NAZI INCEL FAGGOT KEN DOLL.
Filter error: Don't use so many caps. It's like YELLING.
THERE WILL BE CONSEQUENCES FOR YOUR LIES FOR YOUR ENTIRE FAMILY NAZI INCEL FAGGOT KEN DOLL.
Filter error: Don't use so many caps. It's like YELLING. Filter error: Don't use so many caps. It's like YELLING.
Your face is obviously not a secret, but authentication doesn't require secrets. How do you authenticate your wife everyday?
You trust your eyes, and you trust that [eventhough it's technically possible] it's not worth the substantial effort it would take for someone to try to fool your eyes.
Biometric security works the same way. The iPhone has a pretty bullet-proof & un-hackable chain of trust between the 3D sensor and the authentication circuitry--and it's really difficult & expensive to try to trick those circuits with a complicated 3D model. That's the whole ball-game. For the most part there are no secrets involved.
As a Dentist i would like to state that face id recognition systems are compromised too. We face a lot of probs with 3S shape system in our Nice post Dental Clinic too.
And if you want to make your strong passcode even more secure, configure your phone so it doesn't briefly show each character of your passcode as you enter it. Looking over someone's shoulder is even easier than building a fancy fake head.
When someone says, "Any fool can see
I have no idea what a CISSP is and couldn't care less. There's nothing trendy about facial & voice recognition for authentication--it's literally how humans have authenticated one another for the last several millenia. It works really well and it's very hard to trick (despite Mission Impossible 3D mask BS). Critically, it *does not* rely on secrets (although it does rely on 'trusted hardware'). I realize that's hard for you to understand, but take a minute and think hard--you'll get it. I believe in you.
Let me know how that meeting with security goes. I'm sure they will love your "just use faces" idea. If they don't, lecture them about the world changing too fast. Maybe that'll somehow lend some credence to your ridiculous point.
Android is totally open source, so what you're saying is you would never trust your data and privacy with yourself.
I'll take the company obsessed with a completely closed platform over a company obsessed with monetizing every last piece of privacy their customers thought they had.
As for the carrier and my data and privacy, how exactly are they able to peer into my data considering all of it is encrypted at rest on the iPhone and all of it that moves off my phone over their pipes is encrypted as well?
Face recognition systems have been fooled/stymied by photographs, masks, certain patterns of makeup/hair styles, etc... for years.
Secret-based authentication is a reasonable approach--that's one factor. Biometric (face recognition) is another factor. Put them together and you have 2-factor authentication. That's a fine solution for when you need the enhanced security provided by 2-factor authentication.
The whole thread was about your little tantrum that "you can't change your face". That's childish little quip is borne out of you not understanding that biometric authentication doesn't require secrets--and thus there's no reason to ever have to change anything because of concern that the "secret has escaped".
You now kinda understand that, but you're still pouting, mostly likely because the world is changing and you can't deal with that.
If my phone was only protected by a username then you could get into it easily, since my username is not a secret. But if you had my phone in your hand right now there's no reasonable way you could get into it--even if you had a picture of my face or hell even if you had a full 3D model of my face. So explain to me how FaceID is no better than a username.
The problem is this: stupid IT morons can't understand secret-less authentication, they only understand username:password. They keep trying to understand biometric authentication within the paradigm of username:password--and since your face can't be a password then it must be a username.
Literally everyone else on the planet understands FaceID perfectly--because it's exactly the same as how they authenticate other humans every day. And so unsurprisingly, nearly every one on the planet understands security better than stupid IT morons.
Show me a single news story of somebody fooling FaceID with a photograph. It doesn't exist because FaceID *DOESN'T USE THE CAMERA*!
Pretty much nobody uses more than single-factor for access to their smartphone. The whole point of FaceID (and TouchID before that) is that most people were still using 0-factor. Decent security is better than no security.
You are falling into the classic security myth that if security isn't perfect then it is useless. People who understand security know that ALL security is imperfect, the whole point is to increase the cost of defeating the security to the point where it is nolonger economical and criminals move on to an easier target.