Hacker News Reader

Comment by arrrg | Hacker News Reader

It seems much more secure than fingerprints, since that was defeated much more quickly (within a couple days?), with easily lifted prints and a more cost effective (though still somewhat lengthy) method.

This, in comparison, seems much harder and consequently further reduces the realistic attack scenarios where people have to be worried. For most people this is a non-issue. (It mostly already was a non-issue with fingerprints, for the same reasons.)

View on HN

TouchID was spoofed in 2 days and FaceID in 7 days. Still, I feel like the difference in time is not that relevant.

I think the biggest difference in time was given by the "attacker" trying to understand what the FaceID system is looking for exactly, as an algorithm. But once they know that, future attacks should be much faster. Like if they try to bypass someone else's phone, it shouldn't take another 7 days. It could even be hours.

With TouchID they already knew what to do - clone someone's fingerprint. There's no machine learning algorithm that needs to be reverse-engineered there.

>I think the biggest difference in time was given by the "attacker" trying to understand what the FaceID system is looking for exactly, as an algorithm. But once they know that, future attacks should be much faster

Not necessarily, as the algorithm is a NN (IIRC), so it looks for different things on different people too.

Even easier perhaps, with all the news about adversarial networks lately!

Reply on news.ycombinator.com