The difference is that if two people in e.g. a class have the same birthday then there will be a day when those two have birthdays, whereas if two people in the same auditorium have the same code, or face, then that has no implications. There is no process where all faces are cycled through and applied to all phones or similar.

So regardless of how many people in a room, or a country, have the same face you still need to bring your one phone up to 1 million people to unlock it.

More succinctly, there's only 365 possible birthdays while there's 1,000,000 possible "faces".

I don't think that's what Grustaf is saying.

The thing is if two of you have the same birthday then it falls on the same day . But if two of you have the same face, that doesn't mean you have to use the same phone. So unlike the birthday paradox where your birthdays "clash", you'd still have to try everyone's face on everyone's phone.

An actual Birthday Paradox equivalent would be if you had 1,000,000 phones and the 1,179 people in the auditorium, and you assigned people to a phone based on their face recognition ID. Then you would get your high chance that not everyone would get a unique phone.

You missed the point. GP is describing a qualitative difference, not just a quantitative one.

"There's a 50% chance that two people in this room have the same face" is not the same as "there's a 50% someone in this room has the same face as mine". The birthday paradox isn't really useful for conceptualizing FaceID's security.

I'm not saying 1 in 1,000,000 is great, but I don't see how the birthday paradox applies. Assume that I want to analyse whether face unlock is secure enough for me -- why is the chance that anyone else's phone gets unlocked by someone else's face even relevant?

Because if you're an actor with a lot of faces (eg, state level actor with a face db) to feed it, and you're sweeping large numbers of phones rather than trying to hit one in particular, this suggests they'd have an easier time than it sounds like when you're considering it in the private use context.

I think it can be assumed that the facial recognition is rate-limited, just like PIN entries. Even if you had a million phones and a million faces in your database, you could only try perhaps 30 faces on each phone.

If you know generally what the owner looks like, I imagine you could cut down your data set significantly before using it to bruteforce a phone

If you have the kind of surveillance tech people are postulating here, you already have a high-res-enough scan of the actual face of the person you target in order to produce something to unlock their phone.

Not likely - they used professional hollywood mask makers to test against... Remember, this is infrared with a 30k dot projector - the most accurate 3d visual record you could make would appear to be insufficient.

They'd have to be 3d faces. Not impossible. Maybe flexible displays will finally take off to facilitate hacking these things.

You mean like Peter Sellers?

http://cinetropolis.net/the-many-faces-of-peter-sellers-part...

Choosing someone that looks like the owner would increase the odds greatly. You can't narrow down the search field like that with a PIN or a fingerprint.

Especially for groups of people who are less likely to be represented in the training data. Someone with the last name "Tillekeratne" for example is Sri Lankan, and Sri Lankans are probably underrepresented in Apple's training data. If you harvested images of Sri Lankans online you would probably need less than a million to get a false positive.

>If you harvested images of Sri Lankans online you would probably need less than a million to get a false positive.

Bearing in mind that FaceID uses a depth map of the face, you'll need more than photos harvested online. They also specifically said that they've tested against realistic masks to make sure they won't work, so I don't think it'll be quite as bad as you imagine!

> Choosing someone that looks like the owner would increase the odds greatly.

Yeah, like an identical twin, or family member.

One in a million, when the system ensures you only get 5 attempts (or whatever the true number ends up being), seems plenty for me.

I'm already comfortable using Touch ID and that number is much lower.

>> I'm already comfortable using Touch ID and that number is much lower.

Source? I was under the impression that fingerprint recognition was more secure than facial recognition.

Apple says that Touch ID's false positive rate is about 1 in 50,000: https://support.apple.com/en-us/HT204587

This number was also mentioned during the presentation today when they were comparing the two.

It was stated in the keynote that the numbers are much better (an order of magnitude) for face versus fingerprint.

In the keynote they've said that for Touch ID the error ratio was significantly lower, 1:50,000 to be exact.

More secure than 2D facial recognition or 3D facial recognition?

...or, you know, if you steal someone's phone, you might as well flash it over the victim's eyes.

or if it's confiscated and you're compelled to unlock it.

It seems like it'd be a lot easier to compel someone to unlock a phone using FaceID than TouchID and that scares me.

The names FaceID and TouchID are apt. They are IDs. Not passwords. You should unlock your phone by something in your memory. Unlock by face or fingerprint is an anti-feature for me.

Perhaps, but what if they ensured that FaceID only worked when you had both eyes open? It would then, be much easier to be non-compliant than it would with TouchID since it's harder to hold someone's eyes open without obscuring the face than it is to press the phone's home button against someone's finger.

Wink/Blink if you don't want to unlock your phone seems, to me, to give more consent to unlock than a fingerprint.

Ah, yeah, that's what I was trying to get across

When you record your face for the unlock, strike a pose that is not your default expression. Put your hand on your face with the sherlockian "hmmm" expression.

Guards/police won't know, they'll just hold the phone up to your face and try to unlock it.

Since it seems so much less invasive, I'd be worried the the arguments that you shouldn't need a warrant to do it will seem much more persuasive.

iOS 11 will force a PIN if you press the Home button five times (or, on the iPhone X, probably if you press the Siri button five times).

If they remember to look away, it won't unlock. Seems very unlikely to me.

Isn't the chance for the pin code 1 in 10,000?

For a 4 digit pin, yes. I believe iPhone now defaults to a six digit pin (equivalent to the 1 in 1,000,000), and the enclave will delay and lock out repeated attempts. They didn't say, but I would hope a similar lockout is employed on the iPhone X.

I strongly suspect that the number 1,000,000 was chosen due to marketing, and that the actual strength of the security lies in the enclave preventing repeated failures and this feature that disables Face ID by repeatedly pressing the power button.

It's interesting you're modelling the pairs as being unordered.

If person A's face unlocks person B's phone, does the reverse hold? I'd guess it's moderately likely, but not certain (e.g. the chance in the other direction becomes 1 in 1000 instead of the magical 1 in a million).

That's like saying "lightning is much more dangerous than thought, because what matters is not your risk of dying, but the risk of any one of 30,000 people dying".

If the risk is "1 in 1,000,000" that means it's 1 in 1,000,000. People understand that doesn't mean it never happens. But it's orders of magnitude lower than their risk of dying in any given year, so it's factually negligible.

I don't think anyone's considering faceid a "wow" factor in terms of its high security (or lack thereof). It's hard to get the general public excited about levels of security. Face ID is pretty much a hack, one that's existed on android phones for many years, that Apple has to polish as best it can.

I didn't watch the keynote: do they have touch ID on the back?

>> Face ID is pretty much a hack

>> I didn't watch the keynote

This is nothing like the version that's been available on Android for years. Read up on it or watch the keynote before jumping to wild conclusions.

Sorry, I didn't mean to imply that it was "bad" when I said "hack". I meant that it was introduced in order to solve a problem introduced by another design change (i.e. the removal of touch ID).

Well they introduced completely new dedicated hardware components that I've never seen in a smartphone to enable this feature. For me "hack" doesn't do the feature justice.

If using a 30k dot projector, 2 cameras (one IR), and a neural network processor is your idea of a 'hack', I'd love to see what you think an elegantly designed solution is!

You should watch the keynote then. Calling it "existed on android phones" is borderline incorrect as it uses infrared sensors to match 3D models of your face.

Yes, the "hack"-version existed in Androids. You know, the one that can be unlocked with any photo of your face.

This one goes a bit deeper with IR and depth mapping.

There is no TouchID on the X

Nope, no Touch ID. The presenter also failed to unlock via Face ID several times in a row, prompting a "please enter your pin to unlock phone message". Worst time for it to happen.

You are seriously misrepresenting what happened. The display phone was showing the “passcode is required to unlock” screen that iPhones show when they are cold-booted.

Huge mistake, IMO. People really love touch id, and it would've essentially been 'free' had they just moved it to the back. I've been using Huawei's equivalent on the Nexus 6P for over a year now, and it works like a dream.

> People really love touch id

What? TouchID effectively hands your entire phone contents over to the Feds, as it's significantly easier to compel a fingerprint than a passcode.

There is absolutely nothing to "love" about TouchID, unless you work in law enforcement.

The same applies to facial recognition too.

For “several” = 1, unless i missed something...