Watch: Face ID and Touch ID compared
With the introduction of the iPhone X and Face ID, some are concerned that Apple's new biometric system is not as secure or easy to use as the legacy fingerprint-based Touch ID. AppleInsider digs deeper to explain why you shouldn't fear facing the future.
YouTube is full of videos showing people tricking Face ID with elaborate masks, but logically, having your face captured and 3D printed is not a realistic concern for the overwhelming majority of iPhone X owners.
As with Touch ID, all Face ID data stays on a unique chip inside your iPhone X called the Secure Enclave, so there's no way someone can hack your data from the cloud.
Apple has admitted that twins might be able to fool Face ID, so you might need to take precautions in the unlikely event that you have an evil twin.
Some AppleInsider viewers have also expressed concern that Face ID might work by putting sunglasses on someone who is sleeping. Those people simply do not understand how Face ID on the iPhone X works.
The TrueDepth camera's infrared sensors penetrate sunglasses, so it can actually see if your eyes or open or closed, and detect where your eyes are looking -- even through mirrored sunglasses. This is beneficial for Face ID's attention awareness feature, which prevents the iPhone from unlocking until it detects that your eyes are looking at your phone.
Unlike Face ID, where you're protected by the attention awareness feature, Touch ID has no such equivalent. If you have an older iPhone, someone can unlock your Touch ID-equipped device while you're asleep by placing your finger on the home button.
If you're conscious, attention awareness will also prevent unauthorized access, as a user whose iPhone X has been stolen can just avert their eyes to prevent it from being unlocked.
If you're not concerned about someone unlocking your iPhone X by holding it up to your face, you can turn the attention detection feature off in Settings. This will help speed up the process of unlocking with Face ID, at the cost of some security.
Some have complained that Face ID is slower than Touch ID, but simple side-by-side comparisons don't tell the whole story.
Touch ID only has one step for authentication -- scanning your fingerprint. Face ID, meanwhile, has to project infrared dots onto your face, scan those dots, and then authenticate against data stored in the Secure Enclave, a process that adds a small amount of time to the unlock procedure. But the way the iPhone X is implemented, namely as a hands-off security solution, means that Face ID can actually be faster in practice than Touch ID.
It's also worth noting that every successful Face ID unlock makes the system better, as it learns your face in different scenarios and lighting. Over time, the speed of authentication should become faster.
Face ID favors certain parts of your face when it's authenticating, mainly the eyes, nose, and mouth. We actually showed this off by using a small card to cover certain parts of a face, and we found out that when we blocked the mouth or nose, Face ID wouldn't authenticate at all. However, blocking only one eye still allowed Face ID to work.
Once again, the limitations of Face ID are not that different from Touch ID. Imagine using a bit of tape to block a part of your fingerprint while using Touch ID. That's not going to work either.
Face ID may not work in certain conditions like wearing a ski mask to cover your face in the cold, but again, it's no different than Touch ID, where gloves make it unusable.
Touch ID, meanwhile, fails to work if your finger is wet or dirty. Sometimes, when outside in the wintertime, the weather prevents it from working. And if you have any lotions or oils on your fingers, it can also affect Touch ID readings. The system can also fail if you get a cut, or worse, on your finger.
We have experienced Touch ID failing many times with dry fingers, or sweaty when leaving the gym, or if they are wrinkled from spending some time swimming. Even just having the sensor be a little bit dirty or smudged can affect Touch ID as well.
Conversely, Face ID should actually work just fine for all of those situations, even if you have a cut or your face is dirty, or even if your face is a bit swollen.
Now that it's fall, those wearing gloves who own an iPhone X will no longer be held back by Touch ID. Face ID will unlock just fine and users just need to swipe up on the screen. There are many compatible gloves that work fine with touchscreen displays. Just know that if you're wearing a scarf, you'll need to uncover most of your face for Face ID to work.
Although there are many concerns about Face ID, the recently launched iPhone X is only the first implementation of the new technology. There's no doubt that it will continue to be improved in the future -- and not necessarily just with future hardware. Because Face ID is heavily reliant on software, Apple could actually improve performance with future firmware updates.
YouTube is full of videos showing people tricking Face ID with elaborate masks, but logically, having your face captured and 3D printed is not a realistic concern for the overwhelming majority of iPhone X owners.
As with Touch ID, all Face ID data stays on a unique chip inside your iPhone X called the Secure Enclave, so there's no way someone can hack your data from the cloud.
Apple has admitted that twins might be able to fool Face ID, so you might need to take precautions in the unlikely event that you have an evil twin.
Some AppleInsider viewers have also expressed concern that Face ID might work by putting sunglasses on someone who is sleeping. Those people simply do not understand how Face ID on the iPhone X works.
The TrueDepth camera's infrared sensors penetrate sunglasses, so it can actually see if your eyes or open or closed, and detect where your eyes are looking -- even through mirrored sunglasses. This is beneficial for Face ID's attention awareness feature, which prevents the iPhone from unlocking until it detects that your eyes are looking at your phone.
Unlike Face ID, where you're protected by the attention awareness feature, Touch ID has no such equivalent. If you have an older iPhone, someone can unlock your Touch ID-equipped device while you're asleep by placing your finger on the home button.
If you're conscious, attention awareness will also prevent unauthorized access, as a user whose iPhone X has been stolen can just avert their eyes to prevent it from being unlocked.
If you're not concerned about someone unlocking your iPhone X by holding it up to your face, you can turn the attention detection feature off in Settings. This will help speed up the process of unlocking with Face ID, at the cost of some security.
Some have complained that Face ID is slower than Touch ID, but simple side-by-side comparisons don't tell the whole story.
Touch ID only has one step for authentication -- scanning your fingerprint. Face ID, meanwhile, has to project infrared dots onto your face, scan those dots, and then authenticate against data stored in the Secure Enclave, a process that adds a small amount of time to the unlock procedure. But the way the iPhone X is implemented, namely as a hands-off security solution, means that Face ID can actually be faster in practice than Touch ID.
It's also worth noting that every successful Face ID unlock makes the system better, as it learns your face in different scenarios and lighting. Over time, the speed of authentication should become faster.
Face ID favors certain parts of your face when it's authenticating, mainly the eyes, nose, and mouth. We actually showed this off by using a small card to cover certain parts of a face, and we found out that when we blocked the mouth or nose, Face ID wouldn't authenticate at all. However, blocking only one eye still allowed Face ID to work.
Once again, the limitations of Face ID are not that different from Touch ID. Imagine using a bit of tape to block a part of your fingerprint while using Touch ID. That's not going to work either.
Face ID may not work in certain conditions like wearing a ski mask to cover your face in the cold, but again, it's no different than Touch ID, where gloves make it unusable.
Touch ID, meanwhile, fails to work if your finger is wet or dirty. Sometimes, when outside in the wintertime, the weather prevents it from working. And if you have any lotions or oils on your fingers, it can also affect Touch ID readings. The system can also fail if you get a cut, or worse, on your finger.
We have experienced Touch ID failing many times with dry fingers, or sweaty when leaving the gym, or if they are wrinkled from spending some time swimming. Even just having the sensor be a little bit dirty or smudged can affect Touch ID as well.
Conversely, Face ID should actually work just fine for all of those situations, even if you have a cut or your face is dirty, or even if your face is a bit swollen.
Now that it's fall, those wearing gloves who own an iPhone X will no longer be held back by Touch ID. Face ID will unlock just fine and users just need to swipe up on the screen. There are many compatible gloves that work fine with touchscreen displays. Just know that if you're wearing a scarf, you'll need to uncover most of your face for Face ID to work.
Although there are many concerns about Face ID, the recently launched iPhone X is only the first implementation of the new technology. There's no doubt that it will continue to be improved in the future -- and not necessarily just with future hardware. Because Face ID is heavily reliant on software, Apple could actually improve performance with future firmware updates.
Comments
I wipe my iOS device frequently, every time I do I’m required to reenter my fingerprint. Apple will need to have an option to wipe, but keep the Face ID learning. Starting over each time would be a pain in the ass...
Otherwise I simply swipe up even when it shows “locked” as that triggers a scan that then completes the unlock and very rapidly. I wear glasses, with or without them (say in bed when I just want to check something fast) with a hat or not: it just works.
There are a couple inconveniences that I've seen with regard to FaceID. The first is Apple's decision to require auto fill of username/passwords to occur only after FaceID verifies I am "me". Where, with TouchID phones, once past the lock screen the system doesn't require verification to be done again. Not a bad security measure, but does have some impact. The only other problem/inconvenience I've had with FaceID is when holding the phone in landscape orientation - I have had to rotate the phone back to a portrait orientation in order for FaceID to allow auto filling the fields. This only occurs on certain sites where that orientation is more useful, so not a big issue.
I don't know if FaceID only works in portrait orientation, or I'm just "out of view" when the phone is oriented in landscape - haven't played around with it enough to see if moving the phone side to side would change things.
What I generally do is, when asked for the PIN, I just press the side button and then tap the screen/ raise to wake the phone. It then re-authenticates my face and works fine.
The PIN asking happens generally when there is a lag between when the screen wakes up and when the face is in line of sight. The phone catches a partial glimpse of the face, which it cannot authenticate, which is why it asks for the PIN.
http://www.ibtimes.co.uk/hacker-leaked-decryption-key-apples-secure-enclave-severely-affecting-ios-security-1635714
https://daringfireball.net/linked/2016/02/17/ios-security-guide
...and so could such an update be pushed in times of 'need'...?
https://www.apple.com/business/docs/iOS_Security_Guide.pdf
My only issue has been that Face ID doesn’t seem to work more often when I’m holding my iPhone too far away. And by that I mean less than 2 feet but greater than 1 foot. When I bring the phone closer and more directly in front of my face, problem solved. That doesn’t happen 100% of the time but enough so that I’ve noticed.
loaded language. no, they didn’t admit to that, they stated it, at launch.
Face ID is good. if you’re not looking at it when swiping up (which you may not if you’re not used to doing so) and you have attention-detection enabled, then it will fail auth and ask for passcode. just ignore and look at it again — face id auto runs another time right on the passcode screen, you don’t even have to tap Cancel.
To what end? As opposed, say, to a phone without it that stores fingerprint or other biometric information directly on the SSD?
Further, even if you were able to somehow gain access to the enclave, information stored there is encrypted and "one way", meaning that someone can't use it to recreate your face or fingerprint from the stored data.