Hacker News Reader

Comment by daveFNbuck | Hacker News Reader

The suggested alternative is to use passcodes, but then there's no way to unlock your phone without making the unlock code plainly visible.

View on HN

I mean, it's less plainly visible then your face, or even pictures of your face.

I bet you there's an algorithm somewhere that can take a picture of your face and turn it into a 3d model. Then you can take that model, 3d print it, then use it to unlock your phone.

I believe this was the exact attack they were talking about preventing with the "we worked with Hollywood mask-makers" line.

Also, as far as I understand, the demo videos are misleading: these systems (this and Windows Hello) are taking infrared pictures of your face, not visible-light pictures. From their perspective, you look like a (3D depth-tested) network of hot capillaries. This is 1. rather hard to recreate with any amount of sculpture-work, and 2. still identifies you "through" things like foundation/concealer creams.

A few years ago, Apple bought Primsense. Primsense made the sensor in the original Kinect. They've now integrated this into their Face ID system, or at least that's what the keynote suggests. It projects a known random dot pattern and an ASIC does some image processing to figure out the depth in the image (nice patent, by the way).

So they have two bits of info: the 3D reconstruction and an infrared image with/without dots, they also have a colour image using the FaceTime camera. I would be surprised if they didn't use more information than just the point cloud. Biometric security at airports uses a similar system, you can see the laser light when yo go through the e-Passport gates.

https://techcrunch.com/2017/09/12/iphone-x-basically-has-a-k...

Obviously we do not know the exact workings of Apples FaceID, but there certainly is potential for making it very difficult to replicate. But infrared by itself does not reveal much. UV on the other hand, creates an entirely different picture, see this as an example between the two. The first picture, the right side is IR light, the second, the right is UV, and the one revealing hidden features of the face.

http://aplus.com/a/jon-simonassi-infrared-photography-freckl...

I'm reminded of the excellent James Mickens piece on security, where he mentions the difference between (IIRC, don't have it in front of me) securing against an angry ex, and securing against Mossad.

Sure, there are entities out there who could probably crack this if they were inclined to target you. But is that truly -- and don't be hyperbolic here -- a thing that you worry about on a day-to-day basis due to actual experience of having been personally targeted by those entities? And is it never acceptable for a consumer device to be only "secure against the angry ex" versus "secure against Mossad"?

So others can be lazy like I wanted to be and not have to look it up: https://www.usenix.org/system/files/1401_08-12_mickens.pdf (warning: pdf, if that matters to you)

Even worse, your ex probably knows your passcode if you've ever opened your phone in front of them.

I think the difficulty of making that 3d model is a bigger barrier than the lower visibility of a passcode. On my Android phone, it even helpfully highlights each digit as I'm entering it on the lock screen.

"It hurts a lot more to change your face than to change your passcode"

Yeah, but there's not much point in having a passcode if it gets compromised on every use.

Reply on news.ycombinator.com