Hacker News Reader

Comment by baxtr | Hacker News Reader

> A: We used a popular 3D printer. Nose was made by a handmade artist. We use 2D printing for other parts (similar to how we tricked Face Recognition 9 years ago). The skin was also hand-made to trick Apple's AI.

> Q: What's the approximate cost of the mask?

> A: ~ 150 USD

Taken together, the second answer cannot be true. Only if the cost stated is related to material cost only, which is is only one input factor to assess the total cost of this approach

View on HN

What other cost are you referring to? The 3D printer? You can send your design to a studio and they'll print it for you and send it, or you can rent time in some places to get access to a printer, without needing to buy one.

In any case, if it needed only a paper print, you wouldn't count the cost of the printer, since you can print it anywhere.

Human labor is expensive. Not accounting for that is a bit disingenuous.

Artists aren't particularly well paid.

… for pure art, maybe. For commercial artists, especially ones capable of precise results on a deadline and, in this case, also not asking too many questions?

not true either, read up on past stories of skilled forgers of paper currency: their labor was surprisingly inexpensive.

Do you have any citations?

Human labor cost for example, but apart from that: how many masks were used to trick Face ID? I would assume it was not prototype number 1 that did the trick

$150 for a printable parts of the mask.

Then "hand made" skin, which they don't reference cost or time spent creating.

Then "hand made" nose, which they don't reference cost or time spent creating.

Also makeup, which they don't reference cost or time spent applying.

This is a security firm serving up info with HTTP, not HTTPS, ducking every serious question to the point it seems likely they are hiding something. Even if everything they claim is true, their attack vector is so difficult chances of success would seem to be effectively nil.

I assume this was done in Singapore where prices should be a bit cheaper, if you don't have a 3D printer you can always get a service for the 50 USD, and probably give the rest to an art student to make you the nose? :D

Not sure about the "hand-made" skin, but it might just be some white and glossy paint?

This seems to be a Vietnamese firm actually

Nitpicking the cost of the labor to build this mask misses the point of the article: face id is much less secure than Apple claims.

They've shown an "attack vector" that's virtually impossible to reproduce. Someone has to be able to get detailed 3D renders of your face before also stealing your phone. Then they have to get a team of artists to hand craft your nose, hand craft human like skin, 3D print a mask, and a makeup artist to make it all look realistic.

In the end, they've shown is FaceID is just as secure as Apple claimed. Apple never claimed impervious to any attacks, they claimed it would work well an quickly, and be more resistant to attack than TouchID. Requiring a Mission Impossible level team to create a mask that duplicates your face is not a level of attack most customers are concerned with.

TouchID can be defeated simply by stealing the device, lifting the owners fingerprints from said device, and 3d printing duplicate prints to use. FaceID is far more secure than that.

Cost do matter for their claim, because given an indefinite budget every security measure can be broken.

On the surface though, these guys look to be a small company in Vietnam, so I doubt they have an infinite budget, much less a "large" budget for this demonstration.

What claims have they made? That it can’t be fooled by masks? No. That one in a million other faces can open your phone. That’s still fewer people than could open you phone with Touch ID.

At no time that I’m aware have Apple claimed resilience against masks or gelatin fingers.

Yes, Apple claimed that it can't be fooled by masks. The article even has the picture from the slide of the presentation. Did you read it?

Reply on news.ycombinator.com