Is Face ID Safe?

Everybody has already heard of the iPhone X (which goes on sale on November 3rd of this year), and almost certainly, of its most interesting feature, Face ID. But for those still not in the know, however, the feature is basically about using facial recognition technology in order to unlock the iPhone X.

It is a cool feature for sure, but some users may be asking if the technology is safe. Mobile security is a hot topic these days, mainly because of the numerous news of hacks, cyber attacks, and security breaches. And given that just about everybody has some private information saved in their mobile devices, they have every right to be skeptical about a new method of unlocking one’s iPhone.

Facial recognition tech has been around for some time now, but admittedly, the way it has been used on today’s mobile devices leaves plenty of room for improvement. This is so because the tech usually makes use of a phone’s selfie camera, which essentially is only capable of capturing a 2D image, i.e. a flat picture. What’s worse is that the technology can be fooled by substituting a real face with a photograph of the same face.

In the case of the iPhone X, the facial scanning is done through a TrueDepth sensor. As its name suggests, it scans for depth information (3D data), by combining an infrared camera, a dot projector, and a flood illuminator. What happens is that the flood illuminator lights up the user’s face, and then the dot projector shoots 30,000 invisible infrared dots in order to create a profile, and finally, the infrared camera records the dot pattern. Kinect actually uses the same sort of technology by reading the infrared dot pattern of the player. 

So how safe is it? According to Apple, the chances of fooling the Face ID is 1 in 1,000,000, compared to just 1 in 50,000 with the old fingerprint scanning technology used on past iPhone models. 

Just to be clear, facial recognition via 3D sensors is not really a new concept -- Microsoft’s Windows Hello lets users have their face scanned in order to log in to Windows 10 running computer devices. But Apple appears to be the first to use the technology extensively on a smartphone. The cool thing is that Apple is making sure the Face ID feature works on iOS apps as well (the iPhone maker mentioned 1Password, E-Trade, and Mint).

But wait -- what happens to every facial scan information taken by Face ID? Apple is quick to point out that it never stores that data in the cloud. What it is doing instead is save it on an encrypted part of the iPhone X. That would be the Secure Enclave, which is an entirely separate chip that has its own safe boot process and makes full use of a random number generator. Apple can not gain access to any information saved in the Secure Enclave, and neither can app developers.

Face ID also takes advantage of machine learning, allowing it to scan a user’s face despite some changes, like newly grown facial hair, new haircut, or with fashion accessories. And by the way, people need to open their eyes in order to be scanned and they have to look at the phone (remember Minority Report, anyone?). To quickly disable the feature, users need only hold down the Power and Volume buttons for a few seconds.