iPhone FaceID concerns

The thing may sound ridiculous but it’s true: I’m using an iPhone 11 Pro with FaceID enabled and no Alternate Faces. However both me (male) and my sister (who is 4yr old younger than me, and I don’t think I look quite like her) can unlock it. I tried to reset but the issue persists.

It’s not a big deal for me, maybe some genetic stuff is haunting; but it raises my concerns that (although almost impossible, in some rare cases) if two people happened to have the same face decided by the algorithm FaceID would fail.

This is pretty common if you look it up on the internet.

This is why fingerprints could be the better alternative. IIRC while fingerprint unlock is still terrible, face unlock has more false positive match.

As a side note:

Ive tried the no fingerprint sensor/face ID life with just complex passwords and it is horrible. You also have to be concious of the CCTVs around you as well.

Very terrible as I was forced to type my master password in my laptop (because my “burner” phone was fresh and pretty much empty and useless) at the immigration section of the our country’s airport.

Why is fingerprint terrible?

The best solution is the upcoming GrapheneOS feature, which allows you to use biometrics as a 2FA alongside a PIN or a password. You get the best of both worlds.

Unfortunately all modern phones tend to scan your face as a biometric auth

You leave your fingerprints on everything you touch, even a high resolution picture where your fingerprints are visible can be enough to unlock your phone.

You could be rendered unconcious against your will and that would let someone use your fingers against you.

Or in more terrible threat models, have someone cut out your finger. Not sure if a cut finger will work though.

Will we be able to set this up by having a long password for unlocking BFU, and then in AFU a PIN + biometrics (every time)?

Yes.

Maybe if it’s an optical fingerprint sensor.

This isn’t the case for Face ID and Touch ID. The likelihood that a random person can unlock your Face ID is less than 1 in a million while the likelihood for Touch ID is 1 in 50,000. Of course siblings and twins significantly increase those odds tho.

That would work for an optical one I suppose.

That should really not be the case. Unless you are the proverbial one in a million statistical outlier I would guess something might be wrong with your faceID hardware.

For my privacy threat I think this isn’t a big deal. I’m a bit more concern with companies selling my data, or a government somehow spying on me because of something they suspect, and third but the least is someone targeting me however I’m not that important to probably face this problem.

A family member being able to unlock my phone along myself would be very unfortunate but I think I could get along with it. I have quite good relation with my family, everyone respects privacy from each other (nobody reads letters from each other, or journals, etc). Probably if I’d pass away this actually would help in case they need some info that is my phone, :joy:

Nah I’ve experienced this with my sibling across two iPhones that were 5 generations apart. I doubt the Face ID hardware was faulty on both phones. Read reports of this issue online too.

I’m currently helping someone set up their new iPhone and I also have concerns about FaceID. I’m disappointed to see that unlike with Android, Apple doesn’t give you the option to use Touch ID instead of FaceID.

Do most of you use FaceID?

I don’t know if I should set it for the person I am helping, but I am heavily leaning towards not enabling it.

It’s honestly just gonna be a numbers game until they make a phone that pinpricks your finger and analyzes your DNA, lol. Apple says 1:10k vs 1:1MM for Touch/Face, so it’s def a step up for the threat model of a random passerby grabbing your phone. But if you are roommates with a doppelgänger, then you may have to adjust your threat model.

As a data point for your actual question though, yah, I think a vast majority of iOS users do use it. It’s definitely convenient if you like longer passcodes, Private in the sense that it’s supposed to only happen on a local separate chip, and Secure enough for a vast majority of use cases.

If it’s Security you’re really worried about, enable it and pass it around to all of your friends and coworkers for a month to make yourself more comfortable with it.

EDIT: Oh, I should also mention that it has Attention-Aware features for if your eyes are closed or if you’re looking at the tv, so just another useful layer.

What does the double M stand for? Or was that a typo for million?

I’m not, and neither is the person I’m helping, but still it’s worrisome.

I was wondering about users in the privacy community specifically. Do you use FaceID?

Do TouchID and FaceID work differently when it comes to the app store?

I ask this because my grandmother has an iPad with FaceID and an iPhone with ToucheID. She trusts me with her phone’s passcode. However, I had noticed that when I use her iPad, and it recognizes that I am not her, I am prompted to enter her pass code.

However, on her phone with TouchID, if I try to install a new app for her, I am not prompted to enter her pin. I actually have to ask her to place her finger to allow the download.

Is that specific to the app store or specific to TouchID vs FaceID?

Errr…pretty sure 1MM is very widely used for millions, but it could just be redditor-brain. And yah, I personally do use it, because someone else grabbing my phone is already such a low chance of happening. But again, everyone has different threat models, right? So if you’re honestly worried about getting kidnapped and Clockwork Orange’d, then 100% only use a long alphanumeric.

IIRC, there are a few different timeouts and cases that iOS switches to the passcode. The support article I linked mentions a few of them. But as a data point, I personally get it pretty randomly. Like changing a random iCloud setting, or checking the App Store after two months. So I would just be guessing on the EXACT behavior of the biometrics. I do know that if you purposely fail TouchID like five times, you can use the passcode.

At the end of the day though, it’s always a balance between convenience/usability and absolute Security, right? So you kinda gotta make that decision on what’s best for you/them and you guys’ specific situation/worries.

EDIT: As a side note, pretty sure the last iPhone with fingerprints was like the 8 or something. And I dunno if it’s still unable to get the security updates from that malware announced last week. So do a bit of digging on that when you have time, it just triggered my memory of older phones.