With how cheap video surveillance is these days, any PIN that you've regularly entered on your phone in public is probably recorded on video somewhere.
So is your face, of course, but like you said that's much harder to reproduce.
Right, but couldn't somebody just use my actual face? Steal my phone, hold it up to my face for a second to unlock it and then run off?
A really interesting thing to think about is what happens if somebody is in custody and is refusing to unlock their phone, but uses face authentication? Can the police just hold their phone up to their face and unlock the device that way or is there any protection from that in the law?
Should make it more difficult (though not impossible) to force an unlock by waving the phone in an unwilling person's face?
"Excuse me. Is this your phone?"
Or some derivative of that.
You only need to look at the phone for a brief moment. It's designed to quickly unlock. If you had to stare at the phone for 10 seconds it would be a frustrating experience.
The average opportunist thief won't be able to duplicate that key. The best that they can do is use your actual face, within a few feet from you, while you're staring directly at the phone in their hands.
A 3d rendering on a screen is probably enough. The device seems to infer 3D from motion, but would probably be fooled by a rendering or even a recording.
That makes all the interlocutors you had on video chat as potential ID thieves.
Whether biometric access is a password or username is trying to force the wrong paradigm. Going back to first concepts, we had keys and we tried to make them hard to copy but not too inconvenient. The face is the key. No, there's no practical way to re-key this lock, but it's still a lock and key. But the door also has a deadbolt (PIN code) which has to be disengaged for the "face key" to function.
The username concept applies when you have multiple people using the same resource (and don't want to know or reveal whether any 2 people use the same password) -- which again doesn't apply to a single-user device.
Finally, all this combined with the quick "hard lock" of the device (5 taps of power button) gives me the impression of a very thorough approach to security.