Slashdot Mirror
Samsung Galaxy S10 Facial Recognition Fooled by a Video of the Phone Owner (zdnet.com)
Experts have proven once again that facial recognition on modern devices remains hilariously insecure and can be bypassed using simple tricks such as showing an image or a video in front of a device's camera. From a report: The latest device to fall victim to such attacks is Samsung Galaxy S10, Samsung's latest top tier phone and considered one of the world's most advanced smartphones to date. Unfortunately, the Galaxy S10's facial recognition feature remains just as weak as the one supported in its previous versions or on the devices of its competitors, according to Lewis Hilsenteger, a smartphone reviewer better known as Unbox Therapy on YouTube. Hilsenteger showed in a demo video uploaded on his YouTube channel last week how putting up a video of the phone owner in front of the Galaxy S10 front camera would trick the facial recognition system into unlocking the device.
There's a reason apple went with costly 3D imaging. Yes of course there's the prospect of spoofing it with a 3D mask but that's a pretty invasive and premeditated attack. You can't do it on the fly like a video. As has been noted many times, given some preparation it's possible to spoof fingerprint scanners. indeed it seems it's probably easier to spoof fingerprint scanners in many implementations.
Some drink at the fountain of knowledge. Others just gargle.
How could this not be the first unhappy test case?
cease fire stand down,, truth+mercy=justice,, that's the spirit.. further pretense is just more wasted energy?
The thing that surprised me here is that in the field of 3D resonstruction, passive optical flow methods have come to dominate Lidar or moire patterns in probably all use cases aside from cars. And even in cars, for daylight operations it's arguably better than lidar for many practical issues.
But it's not the same as this example beautifully shows.
Optical flow is the technique of inverting a 3D object by the camera-or-object motion such that the parallax effect gives you the information you need to figure out the z-dimension. Lidar just times the distances, and Moire patterns figure out Z from spreading/bending angles of projected lines. Those require active illumination. Whereas optical flow just requires a video (or series of snapshots) from different angles on an object.
THe two reasons optical flow dominates is that first it's insanley cheap and compact (just a tiny camera) and second, because you get the texture/coloring/reflectance values at the same time, but perhaps most of all because it isn't a fixed field of view. Lidar and moire images are from a fixed field of view so you only get a 3D extrusion and you cant rotate the object on screen to see around the side. For that you would need the lidar point of view to move too and at that point you might as well have used optical flow. Of course for perfect metrology Lidar can be better, but seldom is that precision needed, even in a car. THe reason to use it in a car is just for diambiguation and night time driving. IN cars you don't get multiple points of view on distance object either so the optical flow only works on object close by where there's some parallax, but by then you might have driven under the flatbed trailer.
In this case the video image can allow the samsung to do 3D reconstructions. I don't know if they are bothering with that or just going with pure image reconstruction or not. It could be they don't even try to go the extra mile to verify the subject is 3D. I would hope they did since otherwise a photo might suffice to unlock. But here the video supplies the info it could use to a 3D optical flow reconstruction.
And surpise! its not actually measuring real 3D like lidar does.
The thing for me was realizing theses methods differ on that point. Sure I knew it all along, but I hadn't thought about it in this way before.
Some drink at the fountain of knowledge. Others just gargle.
The sensor is a video sensor. It's not exactly human eyes and brain.
That also works with any of the Slashdot editors.
true
but if you show it a picture of a desirable naked adult woman
only creimer's phone automatically shuts off
Consider all the flap about recent AI systems generating artificial head shots that most people can't distinguish from real photos. An algorithm that can create those can, with some existing add-ons, analyze a photo and decide what the Z-axis values are, thus producing a 3-D object. Might be a bit more difficult to fabricate, but I bet these phones can't tell what size the "head" they're looking at is.
If they could capture cicadic movement, that might be cool, but I don't think the cameras have the frame rate to do so.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
With facial recognition software, you don't need fakes. You just need to wave the phone in front of their face and presto, unlocked!
Would not work on an iPhone if the subject had eyes shut, or had triggered the "temporarily disable FaceID" feature before entering an area they thought the phone was at risk.
You seriously think it's HARDER to grab someone's hand and forcibly press one finger on a device? Two people, maybe eve one, could easily manage this with anyone.
You cannot force someone eyes open in a way that FaceID would accept the face as valid...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Easy to combine this 'feature' with the near-omnipresent surveillance state. No need to be asked to submit your face to unlock your phone: good chance they already have sufficient video to do it themselves.
For facial recognition you need a 3d camera. Without it you can fool it with video. There's actually many ways to fool it.
Airport cameras too.
They specifically call it a low security type lock. The iris scanner was removed to make the hole punch smaller.
The recommend using the fingerprint for biometrics.
Does it recognized dark faces? My personal prediction is that when the robot uprising comes, only the darkies will survive because the robots never figured out how to recognize dark faces...
I've abandoned my search for truth; now I'm just looking for some useful delusions.
You're completely stupid Kendall lol, you missed the entire point of this.
If I recall corectly, Samsung were pretty upfront about this, that the face scanning is less secure than the fingerprint scanner.
It's not a bug, it's by design. :)
The lesson after all these years of biometrics is that, to a concerningly large extent, security mechanisms based on biometrics can be bypassed, often by ridiculously pedestrian and simple approaches. Trust biometrics at your own peril.
You're completely stupid Kendall, you missed the entire point of this.
Wearing sunglasses in the car
All of the sunglasses I have work fine with the iPhone X, just make sure what you use does not block IR.
Sitting in my car after I get home at night (too dark)
FaceID works in pitch blackness since it uses an IR emitter to illuminate your face. It cannot be "too dark" for it to work. I use it at night in unlit rooms... and also at night in my car.
Wearing my gamma rays and turtle beach while playing games
Why does this not work. FaceID is pretty flexible.
If you really truly need to wear something that will not pass IR all the time, train your face with that on as an alternate face and disable the attention requirement so it doesn't need to see your eyes to unlock.
I was hoping the X would allow my thumb at the bottom.
Not quite sure I follow, what does "allow my thumb at the bottom" mean?
I've had the iPhone X since last year and I miss nothing about TouchID at all, I find FaceID vastly better in every way.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
biometrics should never be used for security purposes because they are UNREVOKABLE.
from a privacy perspective they are also a bad idea.
given these risks, is it worth using them at all?
it is a convenient way to prevent accidental unlocking and thwart direct access by unsophisticated everyday adversaries (insiders).
why not just stick to swipe patterns/passcodes and the like?
broken biometrics that are easy to trick are by design. i'm sure the feds (among others) want it that way and have indicated their desire in one secret way or another with manufacturers.