Video shows 10-year-old unlocking mother's iPhone X via Face ID

AppleInsider

A video uploaded on Tuesday suggests that the Face ID system on Apple's iPhone X could be fooled not just by twins, but by any family member who bears enough resemblance.

In the the clip, a woman unlocks her phone using Face ID, locks it again, then hands it to her 10-year-old son. The son unlocks it on his first try.

In its current incarnation, Face ID is only able to store one face at a time, meaning that the iPhone made a false match between people of two different ages and sexes.

The technology is meant to adapt to changes in appearance, such as aging, makeup, and facial hair, as well as accessories like hats, scarves, and some sunglasses. That leniency could be what allows two family members to pass for each other, at least when they have a similar facial structure.

Shortly after the iPhone X's launch, it became common to test Face ID with identical twins. Sometimes it passed, other times not.

ihatescreennames

What happened to Face ID not being suitable for people under the age of 13?

wood1208

Kids grow faster than adult and their facial contours change faster so not a validity of Face Id short coming. Remember, Face id is more software than hardware so it gets better and better over time. Hypothetically one can produce multiple genetically engineered kids like sheeps they did a while back and prove Appe's face id failed to differentiate among them.

macxpress

OMG will these videos ever stop? FFS...we all know its not a perfect system, just as TouchID isn't. There's no such thing as a fool proof system. As I remember, we went through the same crap for weeks on end with people trying to get around TouchID and some did as I recall.

Soli

ihatescreennames said:

What happened to Face ID not being suitable for people under the age of 13?

Nothing, and the device wasn't secured for at least 7 days as it gets trained to mother's face, but that's all still a potential issue for a parent if their child can unlock their device.

gatorguy

There's some circumstantial evidence that ambient lighting plays a part in this. After her son's first round of successfully unlocking her phone, with Face ID seeing his face as hers, the mom reset her phone and did the typical Face ID initial setup for a second time but now under bright outdoor lighting. Her son couldn't access her phone afterwards, each of his attempts failed with FaceID working as it should. Then the phone was reset yet again and set up under indoor lighting as she had the first time. Her son then had better success with his face unlocking her phone about half the time, and eventually after several uses working every time. 

So perhaps if you go outdoors on a sunny day for initial setup it will increase the chances that only your face will unlock your iPhone X. Or take Apple's advice and use passcode instead of Face ID if you have serious concerns about siblings or others accessing your phone. Personally I wouldn't. Heck I could not care any less if my wife wishes to use my phone when hers is in the bedroom or wherever. 

Now why ambient lighting conditions would have any impact on Face ID is a good question. I don't know.

StrangeDays

i’d like to know how long it was from the time it was initially configured to her face. 

negociarlaw

Cute video. The kid is funny too. 

If any major network reports on this, Apple will have explaining to do. 

tulkas

If the kid knows her passcode and has used it to unlock the phone, then his facial data is added to the secure enclave in order to augment the existing data and keep it current (i.e. a guy growing a beard, getting tanned, etc).

From Ars (related to the mask earlier but applies here too):

According to a white paper Apple published earlier this month, Face ID takes additional captures over time and uses them to augment enrolled Face ID data. If the researchers trained Face ID over time to work with the mask, they were giving themselves an advantage a real-world attacker wouldn't have. https://arstechnica.com/information-technology/2017/11/hackers-say-they-broke-apples-face-id-heres-why-were-not-convinced/

i.e. it is possible it is working exactly as it is supposed to, assuming the son "taught" the X that he was her.

Edit: oh, sounds like they didn't train it with his face at all. hmmm

rob53

The only way I’ll believe any of these is if a lab dud the testing usin rigorous controls, i.e., not having both people in the room at the same time and not allowing the primary user to enter the pin code (controls like these keep second person from cheating). I’m sure this is how Apple tested it. Add different initial and subsequent lighting to the testing as well as number of owner unlocks before testing on someone else. 

ihatescreennames

Soli said:

ihatescreennames said:

What happened to Face ID not being suitable for people under the age of 13?

Nothing, and the device wasn't secured for at least 7 days as it gets trained to mother's face, but that's all still a potential issue for a parent if their child can unlock their device.

I agree, parents should be keeping their phones (among other things) secure from their children, but I can’t begin to tell you how many people I’ve seen/know who either don’t use a passcode OR let their kids know their passcode so they can hand their phone over and let the kid use it unfettered.  

And you’re right, it’s a potential issue. But people shouldn’t be complaining when they aren’t using something correctly.  Let Face ID learn who you are before trying to defeat it.  I don’t tell my home security company their system deosn’t work before arming it.

dewme

StrangeDays said:

i’d like to know how long it was from the time it was initially configured to her face. 

Yes, and I'd also like to see whether the phone was trained to accept the son's face ahead of time. Not trying to defend or refute the claim that the video implies, but I'd like to see the experiment repeated starting at the very first initialization/training steps and proceeding to the son attempting to unlock the phone with the phone never having seen his face before. It's insufficient to reach a conclusion in this case without having any semblance of it being a controlled experiment. 

Soli

ihatescreennames said:

Soli said:

ihatescreennames said:

What happened to Face ID not being suitable for people under the age of 13?

Nothing, and the device wasn't secured for at least 7 days as it gets trained to mother's face, but that's all still a potential issue for a parent if their child can unlock their device.

I agree, parents should be keeping their phones (among other things) secure from their children, but I can’t begin to tell you how many people I’ve seen/know who either don’t use a passcode OR let their kids know their passcode so they can hand their phone over and let the kid use it unfettered.  

And you’re right, it’s a potential issue. But people shouldn’t be complaining when they aren’t using something correctly.  Let Face ID learn who you are before trying to defeat it.  I don’t tell my home security company their system deosn’t work before arming it.

Sure, and that is the beauty of Touch ID (and now Face ID); it's allowed people who would never had used a PIN to keep their phones secure.

rogifan_new

Very skeptical about this. And we know every tech publication under the sun would love nothing more than to be able to say someone hacked or spoofed Face ID. Something tells me we don’t have the whole story here.

gatorguy

rob53 said:

The only way I’ll believe any of these is if a lab dud the testing usin rigorous controls, i.e., not having both people in the room at the same time and not allowing the primary user to enter the pin code (controls like these keep second person from cheating). I’m sure this is how Apple tested it. Add different initial and subsequent lighting to the testing as well as number of owner unlocks before testing on someone else. 

This was done three times if you go to the source article at Wired. In two of the the three resets the son gained access, and there's a very plausible explanation for why. They explain that the lighting conditions under which the initial setup is done may play a big part in whether a similar face, ie 10-year old son, will be able to unlock your phone. You should have a read.

jason98

ihatescreennames said:

What happened to Face ID not being suitable for people under the age of 13?

What happened to common sense? Isn't an ability of your kids to unlock your phone defeats the purpose of Face ID? 

gatorguy

dewme said:

StrangeDays said:

i’d like to know how long it was from the time it was initially configured to her face. 

Yes, and I'd also like to see whether the phone was trained to accept the son's face ahead of time. Not trying to defend or refute the claim that the video implies, but I'd like to see the experiment repeated starting at the very first initialization/training steps and proceeding to the son attempting to unlock the phone with the phone never having seen his face before. It's insufficient to reach a conclusion in this case without having any semblance of it being a controlled experiment. 

All you had to do was read the source article. The phone was reset multiple times to test Face ID initializing and use under different conditions, and where it was assured the phone could not have "seen" her son during the setup. 
https://www.wired.com/story/10-year-old-face-id-unlocks-mothers-iphone-x/

StrangeDays

dewme said:

StrangeDays said:

i’d like to know how long it was from the time it was initially configured to her face. 

Yes, and I'd also like to see whether the phone was trained to accept the son's face ahead of time. Not trying to defend or refute the claim that the video implies, but I'd like to see the experiment repeated starting at the very first initialization/training steps and proceeding to the son attempting to unlock the phone with the phone never having seen his face before. It's insufficient to reach a conclusion in this case without having any semblance of it being a controlled experiment. 

The macrumors version of this story has more details - the parents say it was immediately after initializing it on mom. considering their resemblance and the statement on children, this doesn’t seem surprising. mom needs to train it on her face longer. 

“We were sitting down in our bedroom and were just done setting up the Face IDs, our 10-year-old son walked in anxious to get his hands on the new iPhone X. Right away my wife declared that he was not going to access her phone. Acting exactly as a kid would do when asked to not do something, he picked up her phone and with just a glance got right in.”

ben20

That is bad. Kids will always try to get into phones/iPads to play with them, delete a few apps apps, check your notification etc. But you can't setup your spouse as second user on it? 

StrangeDays

gatorguy said:

dewme said:

StrangeDays said:

i’d like to know how long it was from the time it was initially configured to her face. 

Yes, and I'd also like to see whether the phone was trained to accept the son's face ahead of time. Not trying to defend or refute the claim that the video implies, but I'd like to see the experiment repeated starting at the very first initialization/training steps and proceeding to the son attempting to unlock the phone with the phone never having seen his face before. It's insufficient to reach a conclusion in this case without having any semblance of it being a controlled experiment. 

All you had to do was read the source article. 

What source article? This AI story doesn’t have a Wired reference link unless I’m missing it.

rob53

gatorguy said:

rob53 said:

The only way I’ll believe any of these is if a lab dud the testing usin rigorous controls, i.e., not having both people in the room at the same time and not allowing the primary user to enter the pin code (controls like these keep second person from cheating). I’m sure this is how Apple tested it. Add different initial and subsequent lighting to the testing as well as number of owner unlocks before testing on someone else. 

This was done three times if you go to the source article at Wired. In two of the the three resets the son gained access, and there's a very plausible explanation for why. They explain that the lighting conditions under which the initial setup is done may play a big part in whether a similar face, ie 10-year old son, will be able to unlock your phone. You should have a read.

Looking at the video, the boy was in the room looking at the phone. This is not a controlled test. I have no idea how wide of an angle the camera uses. The only valid test is to have the two people in different rooms at all times.