Comment by ralfd | Hacker News Reader

Comment by ralfd | Hacker News Reader

Parent Full thread

> In February, we reported that thieves, often in and around bars at night, watch iPhone owners tap in their passcodes, then steal the targets’ phones. With this short four- or six-digit string, criminals can change the Apple account password and rack up thousands of dollars in charges using Apple Pay and financial apps. […]

> Apple introduced the optional recovery key in 2020 to protect users from online hackers. […]

> iPhone thieves with your passcode can flip on the recovery key and lock you out. And if you already have the recovery key enabled, they can easily generate a new one, which also locks you out. […]

> So long as you can access your iPhone, you can add or reset a recovery key without any extra credentials. Apple says this is a convenience measure. However, it also gives thieves easier access.

Uff! Security vs convenience is a difficult problem, but only protecting against remote/online hacking is a massive oversight! One shouldn’t underestimate the incentives for thiefs stealing your passcode and device in real life.

But why do the iPhone users tap in their passcodes in the first place when there is faceID and touchID available?

My wife got an iPhone recently, based on her experience users tap in the passcodes almost constantly because FaceID doesn't f**king work, and no fingerprint reader is present on the device.

Most of the time she still reaches for her old Android because it unlocks instantly (and properly, not to a stupid lock screen!) with a fingerprint.

In 2023 faceid works flawlessly for me, even when wearing a mask and glasses. I only use the passcode to unlock after a reboot. If your wife is having this much trouble she probably should try retraining it on her face.

How is this possible, unless you're shilling? I just got a new iPhone 11 in the box and FaceID doesn't work: if you're too close, too far, have a face mask on, in the dark, next to someone, randomly fails, whatever.

My Samsung on the other hand always opens flawlessly with a fingerprint scanner.

What is Apple trying to avoid here by not including one?

I think they want to save a couple of dollars on manufacturing. Maybe they also don't want to "copy" the sensible locations of fingerprint scanners from non-Apple devices.

Why would I bother shilling? How did you get a new 11? The current generation is 14. The oldest I can see they sell is 12. The X and 11 didn’t have particularly great Face ID support for lack of quality enough hardware.

The dark makes no sense. It’s not using visible spectrum, it uses IR laser dots and flood illuminator coupled with an IR camera to map and photograph your face in 3d.

Mask Auth only works afaik with iPhone 12 and greater.

Apple used to include Touch ID. Some devices still have it (iPads etc). They are trying to avoid something though - there’s no physical space on the devices for finger print scanner. The iPad integrates it into the on/off button which is large and exposed. But most phones have very small physical buttons that are typically covered by cases. The rest of the screen (sans notch) is edge to edge touch screen.

On my iPhone 14 the Face ID is basically flawless and very fast. I would suspect your “new” device that’s second gen Face ID is simply not as capable as the fifth gen on market today.

But, dude, if you like android, go for it.

FaceID is a lot more secure that TouchID.

> While there are mixed opinions from privacy experts on which is more secure, Apple claims that Face ID is 20 times more secure than Touch ID. While the chances of someone unlocking your iPhone using a spoofed fingerprint is one in 50,000, this number grows exponentially to a false positive of one in a million when it comes to Face ID.

Source for this quote?

She's tried retraining it about 6 times, at my insistence. It's just crap. I've since paid more attention to other iPhone users I know, and they seem to be doing a lot of passcode entry too.

Does she look at the camera while unlocking? It optionally requires your visual attention to successfully unlock. Otherwise your experiences are completely at odds with our experiences. I’m family tech support for nearly 15 iOS users and none have this experience.

I personally have disabled “Require Attention for Face ID” on my IPhone X which improves performance significantly.

For some reason Face ID frequently will fail and the phone will demand the passcode.

This happened to me twice in the span of an hour while the phone was face up on my desk at work. I can only guess Face ID is being triggered repeatedly by some feature and is failing so it is disabled.

Perversely this means I’m not as willing to use a very long complex passcode because I don’t want to have to type all that if I’m in a rush and Face ID stops working suddenly.

Personally I would prefer they bring back Touch ID.

Touch id is still available on iphone SE’s but those are for old people /s

It's an expensive option because it relies on the Apple Watch, but Watch unlock can be handy as a backup to Face ID. The Watch notifications for Watch unlock might also help you get a sense of what seems to be trying to unlock your phone.

It's probably the notifications on your lock screen triggering a Face ID check in case you want to read what they say. You could reduce the number of notifications that you receive, or use a Focus Mode while at work, or keep the phone in a pocket or face down/in a dark place.

No idea about iPhones, but on Android the face recognition is 70/30, and my fingerprints are unreadable.

This would not be OS related but hardware related. I've never had a Samsung that couldn't read my finger prints. In fact I have a Samsung tablet from 2014 that uses facial recognition and it generally always works the first time, if not the second.

> But why do the iPhone users tap in their passcodes in the first place when there is faceID and touchID available?

1. If you reboot your phone, you have to enter your passcode.

2. Some people prefer to use a passcode for legal reasons. Essentially the police can compel you to unlock your phone via faceID and touchID, but not passcode.

3. Some people might just like it and/or be used to it.

2 can be mitigated by squeezing the top two buttons of the phone until it vibrates. Any attempt to go to the emergency contact/power off screen disables Face ID/Touch ID until after the next passcode use. (You don't have to entirely reboot.)

That is a fair point.

But sometimes you don't have the time. From what I recall, the police were able to apprehend Ross Ulbricht (of Silk Road fame) before he could log out of his computer.

At least that's what happened in the (excellent) movie https://www.imdb.com/title/tt7937254/

Reply on news.ycombinator.com