{"id":17847,"date":"2017-09-14T17:12:27","date_gmt":"2017-09-14T15:12:27","guid":{"rendered":"https:\/\/www.kaspersky.co.za\/blog\/?p=17847"},"modified":"2019-11-15T13:41:06","modified_gmt":"2019-11-15T11:41:06","slug":"apple-face-id-security","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.za\/blog\/apple-face-id-security\/17847\/","title":{"rendered":"What is iPhone X Face ID and how secure is it?"},"content":{"rendered":"<p>This week the iPhone <a href=\"https:\/\/www.apple.com\/iphone-x\/\" target=\"_blank\" rel=\"noopener nofollow\">changed<\/a> in some big ways. Probably the most obvious is the missing \u201cHome\u201d button. That\u2019s right: Apple\u2019s newest flagship smartphone, the iPhone X, has no fingerprint scanner (aka Touch ID). It\u2019s been replaced by something called Face ID.<\/p>\n<p>Those who watched Apple\u2019s presentation will already be somewhat familiar with Face ID, but we\u2019ll shed some light on this technology, and then turn to the area that\u2019s always on our minds: security.<\/p>\n<h2>What is Apple Face ID and True Depth Camera<\/h2>\n<p>In brief, Apple\u2019s Face ID is a technology used to recognize a user\u2019s face and unlock the new iPhone as well as confirm payments by comparing its view of their face with a picture stored in the iPhone\u2019s memory. For that, the iPhone X uses a special camera called the True Depth Camera.<\/p>\n<p>The small peninsula in the upper part of iPhone X\u2019s front panel \u2014 the only part not covered by its massive display \u2014 is tightly packed with sensors and other electronics. In addition to the usual front-facing camera, microphone, speaker, and proximity and ambient light sensors, the phone has three new things: an infrared camera, flood illuminator, and dot projector.<a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/103\/2017\/09\/14170335\/apple-iphonex-true-depth-camera.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/103\/2017\/09\/14170335\/apple-iphonex-true-depth-camera-1024x640.png\" alt=\"\" width=\"1024\" height=\"640\" class=\"aligncenter size-large wp-image-17849\"><\/a><\/p>\n<p>These three new parts make up the True Depth camera, which maps your face and takes special 3-D pictures that are used to authenticate you. Here\u2019s how it works.<\/p>\n<p>A flood illuminator is basically just a source of light used to brighten your face in low-light conditions so the camera can get a good picture. The dot projector projects 30,000 invisible infrared dots onto your face. Using those dots, the infrared camera captures your face.<\/p>\n<p>The dots help outline features and create something like a 3-D map of your face. When setting up Face ID, you will need to rotate your head slightly so that the iPhone X can map your face from different angles.<\/p>\n<p>From then on, whenever you attempt to use Face ID, the software will take a shotwith the IR camera, and<\/p>\n<p>if enough features match the 3-D map stored on the phone, you are considered a legitimate user. If the picture doesn\u2019t look quite like the map, you\u2019ll have a chance to repeat the process. At this point, the technology works like a fingerprint scanner, but with one significant difference.<\/p>\n<p>Apple has built in a special coprocessor that is suitable for machine-learning algorithms, which make the system learn and adapt to you better \u2014 which, in turn, makes the recognition faster as well as helps the system adapt to changes in your facial expression, hair, and accessories. Apple says that if you decide to, say, wear a scarf or grow a beard, the system will still recognize you.<\/p>\n<h3>Face ID\u2019s security features<\/h3>\n<p>Now that we know how Face ID works, let\u2019s discuss how it differs from traditional facial recognition techniques, which, as we pointed out in <a href=\"https:\/\/www.kaspersky.com\/blog\/surveillance-cameras\/9873\/\" target=\"_blank\" rel=\"noopener nofollow\">earlier posts<\/a>, are quite insecure. Apple has implemented several features to ensure that Face ID works smoothly and is more secure than other systems.<\/p>\n<p>First, Face ID isn\u2019t fooled by photos \u2014 flat pictures just don\u2019t have a 3-D map of infrared dots on them. By comparison, Samsung\u2019s Face Unlock, implemented in the company\u2019s newest phones, was easily fooled by selfies.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Samsung Galaxy Note 8 Facial Recognition Test: <a href=\"https:\/\/t.co\/dVooMPMgfh\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/dVooMPMgfh<\/a><\/p>\n<p>\u2014 Mel Tajon (@MelTajon) <a href=\"https:\/\/twitter.com\/MelTajon\/status\/904058526061830144?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">September 2, 2017<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Second, Apple claims that it has even tested Face ID against masks that were basically copies of people\u2019s faces, and yet Face ID stood strong and didn\u2019t let anyone but the owner of the device in. Apple\u2019s Phil Schiller said that the odds of someone unlocking your Face ID\u2013secured iPhone X with their face are 1 in a million. Compared with 1 in 50,000 for the Touch ID fingerprint reader, that\u2019s quite impressive.<\/p>\n<p>Apple also mentioned that using Face ID requires concentration and that you can\u2019t use it while looking away from the smartphone or with your eyes shut. As far as we know, the True Depth camera does not have an iris scanner, but it probably has to rely on some data about your eyes and the direction of your glance as well \u2014 mostly so as not to be fooled by lifelike masks.<\/p>\n<p>Third, you don\u2019t have to worry about someone stealing your face \u2014 the images captured by Face ID are kept in the encrypted memory of Apple\u2019s special coprocessor, which is called Secure Enclave. They are processed only on the device and are never sent to Apple\u2019s servers or elsewhere. Speaking of processing, it doesn\u2019t leave the Secure Enclave either, so no apps can gain access to your face scans.<\/p>\n<blockquote class=\"wp-embedded-content\" data-secret=\"bG0mQF8rOK\"><p><a href=\"https:\/\/threatpost.com\/hacker-publishes-ios-secure-enclave-firmware-decryption-key\/127524\/\" target=\"_blank\" rel=\"noopener nofollow\">Hacker Publishes iOS Secure Enclave Firmware Decryption Key<\/a><\/p><\/blockquote>\n<p><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"\u201cHacker Publishes iOS Secure Enclave Firmware Decryption Key\u201d \u2014 Threatpost - English - Global - threatpost.com\" src=\"https:\/\/threatpost.com\/hacker-publishes-ios-secure-enclave-firmware-decryption-key\/127524\/embed\/#?secret=dV5h9tcUTs#?secret=bG0mQF8rOK\" data-secret=\"bG0mQF8rOK\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n<p>However, a security researcher has already <a href=\"https:\/\/threatpost.com\/hacker-publishes-ios-secure-enclave-firmware-decryption-key\/127524\/\" target=\"_blank\" rel=\"noopener nofollow\">found a vulnerability<\/a> in Secure Enclave. The vulnerability was fixed, but that doesn\u2019t mean there won\u2019t be another \u2014 and the next one might be one an attacker can bypass or use to leak your data.<\/p>\n<p>As Schiller himself also noted during the announcement, there\u2019s no such thing as an absolutely secure system. Based on Face ID design, we can say that the new iPhone\u2019s facial recognition should be more secure than that of traditional facial recognition done by a simple 2-D front-facing camera, and it might be more secure than the Touch ID fingerprint sensor. However, security researchers from all over the world will soon be trying to hack this system, so whether it is secure enough has yet to be determined. Fortunately, the traditional six-digit PIN code is still an option. Like any PIN, it is, of course, not ultimately secure, but at least it can\u2019t leak your biometric data to hackers.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How facial recognition works in the new Apple iPhone X \u2014and is it secure enough for you to usetrust?<\/p>\n","protected":false},"author":675,"featured_media":17848,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1789],"tags":[14,1232,2651,301,26,2650,97,822,2652],"class_list":{"0":"post-17847","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-apple","9":"tag-biometrics","10":"tag-face-id","11":"tag-facial-recognition","12":"tag-iphone","13":"tag-iphone-x","14":"tag-security-2","15":"tag-touch-id","16":"tag-true-depth-camera"},"hreflang":[{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/apple-face-id-security\/17847\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/apple-face-id-security\/11211\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/apple-face-id-security\/9266\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/apple-face-id-security\/5002\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/apple-face-id-security\/12670\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/apple-face-id-security\/11732\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/apple-face-id-security\/11293\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/apple-face-id-security\/14364\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/apple-face-id-security\/14241\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/apple-face-id-security\/18732\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/apple-face-id-security\/4549\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/apple-face-id-security\/18512\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/apple-face-id-security\/7351\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/apple-face-id-security\/14608\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/apple-face-id-security\/17918\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/apple-face-id-security\/17859\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.za\/blog\/tag\/iphone\/","name":"iphone"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/17847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/users\/675"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/comments?post=17847"}],"version-history":[{"count":4,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/17847\/revisions"}],"predecessor-version":[{"id":24052,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/17847\/revisions\/24052"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/media\/17848"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/media?parent=17847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/categories?post=17847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/tags?post=17847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}