Face ID on iOS 12 allows two different faces to unlock the same iPhone

Posted:
in iPhone edited June 5
Though it went unannounced at Apple's WWDC 2018 keynote on Monday, the first iOS 12 beta allows two different people to register their face with Face ID on iPhone X, addressing in part one of the biggest downsides of Apple's new biometric authentication technology.





Face ID has been an absolute joy to use since it launched with the iPhone X. The technology is fast, seamless and, most importantly, highly secure -- a major improvement over fingerprint-based Touch ID systems in use on iPhone 8, iPad and MacBook Pro.

One of its weaknesses, however, is that users can only set up one face (their own) as the handset's registered user. Touch ID, on the other hand, allows users to store up to five fingerprints, a feature some owners use to share their device with family members.

With iOS 12, Apple has added an option in Face ID & Passcode settings labeled "Set Up an Alternate Appearance." It's described as an option to enroll an alternate look, one that complements the main face that's assigned to unlock a target iPhone. Like multiple fingerprints with Touch ID, support for two "looks" on iPhone X is a perfect workaround for adding a second registered user.




It should be noted that the feature is technically a fix for iPhone X owners who run into trouble with Face ID, not official support for multiple users. For example, the "alternate look" option might be used to compensate for extremely strong prescription lenses that distort the laser dot pattern emitted by TrueDepth's vertical-cavity surface-emitting laser, or VCSEL, which in turn causes the authentication process to fail.

That said, we were able to set up Face ID with two users, a woman and a man, who look nothing alike. The process completed without a hitch and both users now have the ability to unlock the same iPhone X using Face ID.

If you end up resetting Face ID, it's worth noting that both faces will need to be registered again to work properly.

Comments

  • Reply 1 of 18
    smiffy31smiffy31 Posts: 167member
    Could this be used to set up a 90 degree rotated face for landscape unlocking ?

    repressthismike1watto_cobra
  • Reply 2 of 18
    gatorguygatorguy Posts: 19,284member
    I would suspect that setting up FaceID with two totally different faces with little to nothing in common would severely impact the security of the feature. As the article mentions this is intended to fix problems with a specific face having minor recognition issues (ie the glasses) but overall similarities, but probably not wholesale changes. My guess is that faces that belong to neither of you will be far more likely to successfully unlock your phone
    edited June 5 lkrupprepressthisarthurbajony0Alex1N
  • Reply 3 of 18
    22july201322july2013 Posts: 190member
    Prescription lenses cause problems with Face ID? How about contact lenses? Or nose rings? Or false teeth? Or a wood eye?
  • Reply 4 of 18
    tmaytmay Posts: 3,145member
    gatorguy said:
    I would suspect that setting up FaceID with two totally different faces with little to nothing in common would severely impact the security of the feature. As the article mentions this is intended to fix problems with a specific face having minor recognition issues (ie the glasses) but overall similarities, but probably not wholesale changes. My guess is that faces that belong to neither of you will be far more likely to successfully unlock your phone
    I would expect a second generation FaceID this fall. Whether that will allow officially support two users is unknown, but this is a hopeful sign.

    Meanwhile, I await FaceID in the next generation of iPad Pro as well.

    watto_cobra
  • Reply 5 of 18
    Rayz2016Rayz2016 Posts: 4,210member
    gatorguy said:
    I would suspect that setting up FaceID with two totally different faces with little to nothing in common would severely impact the security of the feature. As the article mentions this is intended to fix problems with a specific face having minor recognition issues (ie the glasses) but overall similarities, but probably not wholesale changes. My guess is that faces that belong to neither of you will be far more likely to successfully unlock your phone
    But in the real world, the chances of this being spoofed maliciously are still remote (1 in 500,000), and still better than using TouchID (1 in 50,000), which has also suffered no spoof that would work without a team of engineers, a chemical lab, and a whole lot of luck.


    edited June 5 Alex1Nwatto_cobra
  • Reply 6 of 18
    Rayz2016Rayz2016 Posts: 4,210member
    Prescription lenses cause problems with Face ID? How about contact lenses? Or nose rings? Or false teeth? Or a wood eye?
    Not for me. My prescription lenses are tinted as well.
    repressthisAlex1Nwatto_cobra
  • Reply 7 of 18
    georgie01georgie01 Posts: 179member
    That feature could be handy, but I’m mostly happy hearing him refer to his ‘wife’.
    watto_cobra
  • Reply 8 of 18
    TaiGameKTaiGameK Posts: 2unconfirmed, member
    I use more fingerprint
  • Reply 9 of 18
    gatorguygatorguy Posts: 19,284member
    Rayz2016 said:
    gatorguy said:
    I would suspect that setting up FaceID with two totally different faces with little to nothing in common would severely impact the security of the feature. As the article mentions this is intended to fix problems with a specific face having minor recognition issues (ie the glasses) but overall similarities, but probably not wholesale changes. My guess is that faces that belong to neither of you will be far more likely to successfully unlock your phone
    But in the real world, the chances of this being spoofed maliciously are still remote (1 in 500,000), and still better than using TouchID (1 in 50,000), which has also suffered no spoof that would work without a team of engineers, a chemical lab, and a whole lot of luck.


    That's exactly the stat that probably gets impacted if using two totally different faces to unlock your phone. If I understand the way FaceID works it could result in a fairly wide range of facial "points" being in the recognized range and not just those specific to the wife's face and the husband's face. As far as your iPhone is concerned that is still one person but now with a wide range of nose/mouth size and shape, and different eye spans and shapes. FaceID is then going to try to come up with a recognition algorithm that melds the two. I think that could potentially be less secure, perhaps far less, than a fingerprint unlock. Just guessing of course.
    arthurbaAlex1N
  • Reply 10 of 18
    lkrupplkrupp Posts: 6,403member
    I’m calling out AI on this. As reported this feature does NOT support multiple users and even AI calls it a work-around. “Working around” security features is not a good idea for any user. Apple needs to make it perfectly clear that multiple users are not supported and could possibly compromise the security of Face ID. Users need to be informed that if they work around Face ID so they can have two different users Apple is not liable for any security breach that may occur because of their misuse of the feature. 
    edited June 5 gatorguyAlex1Nwatto_cobra
  • Reply 11 of 18
    vadimyuryevvadimyuryev Posts: 146member, editor
    lkrupp said:
    I’m calling out AI on this. As reported this feature does NOT support multiple users and even AI calls it a work-around. “Working around” security features is not a good idea for any user. Apple needs to make it perfectly clear that multiple users are not supported and could possibly compromise the security of Face ID. Users need to be informed that if they work around Face ID so they can have two different users Apple is not liable for any security breach that may occur because of their misuse of the feature. 
    If Apple doesn't have the capability to register, learn and train Face ID with two faces, then someone else will.
    The neural engine shouldn't be stupid enough to mix two different faces together while training.

    There's no way Apple accidentally let this happen. 
    arthurbaAlex1N
  • Reply 12 of 18
    sphericspheric Posts: 1,628member
    Prescription lenses cause problems with Face ID? How about contact lenses? Or nose rings? Or false teeth? Or a wood eye?
    No, no, no, no, and I doubt it.
    watto_cobra
  • Reply 13 of 18
    gatorguygatorguy Posts: 19,284member
    lkrupp said:
    I’m calling out AI on this. As reported this feature does NOT support multiple users and even AI calls it a work-around. “Working around” security features is not a good idea for any user. Apple needs to make it perfectly clear that multiple users are not supported and could possibly compromise the security of Face ID. Users need to be informed that if they work around Face ID so they can have two different users Apple is not liable for any security breach that may occur because of their misuse of the feature. 
    You and I are pretty much on the same page.
  • Reply 14 of 18
    If the second Face ID setup is stored as a completely independent set of data - like they do with multiple fingerprints - then this really doesn’t decrease the security very much at all. If, however, the second face is somehow merged with the first one to come up with a “facial average” composite, then I’d imagine this could in fact lessen the security of the system. A third option would be to use the two faces to come up with a common set of features to focus on, overlooking the differences between them.

    I don’t see that second scenario as likely, and I don’t think the third would work at all for allowing my wife to unlock my phone.

    Before we get too terribly excited here, I think more research is needed to understand how this actually works. In any case, let’s remember this is an unannounced feature, so it may change radically - or disappear completely - by the time they get to full release.
    Alex1Nwatto_cobra
  • Reply 15 of 18
    gatorguygatorguy Posts: 19,284member
    If the second Face ID setup is stored as a completely independent set of data - like they do with multiple fingerprints - then this really doesn’t decrease the security very much at all. If, however, the second face is somehow merged with the first one to come up with a “facial average” composite, then I’d imagine this could in fact lessen the security of the system. A third option would be to use the two faces to come up with a common set of features to focus on, overlooking the differences between them.

    I don’t see that second scenario as likely, and I don’t think the third would work at all for allowing my wife to unlock my phone.
    That was already explained in the article. It's very likely the second scenario IMO. This is intended as a fix only for a single unique user who is having some issue with a particular pair of glasses (or something) causing FaceID to fail once in awhile. So yeah it's probably merging the two into one.
    edited June 6 Alex1N
  • Reply 16 of 18
    sphericspheric Posts: 1,628member
    Why would it merge them? Touch ID doesn’t merge your multiple fingerprints into one, either. 
    Alex1Nwatto_cobra
  • Reply 17 of 18
    gatorguygatorguy Posts: 19,284member
    spheric said:
    Why would it merge them? Touch ID doesn’t merge your multiple fingerprints into one, either. 
    Of course you can't merge fingerprints. Since FaceID "improves over time" with use then it seems fairly obvious that various images from slightly different angles and assorted lighting conditions are being merged to create a face recognition algorithm unique to your specific features. If it's not really unique to your face but instead using an assortment of measurements over a much broader range as it most certainly is if measuring a small face/bone structure along with a larger one then I don't know how you could question whether the security has been somewhat compromised, perhaps even severely.
    edited June 6
  • Reply 18 of 18
    Alex1NAlex1N Posts: 37member
    AI should test their 'tweaked' iPhone X on a range of people other than the original two, and see if it still unlocks.

    That would be interesting. I wonder what sort of sample size would be necessary before (or whether) you could shout 'BINGO!'.
    watto_cobra
Sign In or Register to comment.