My 10-Year-Old Son Can Unlock My Wife's iPhone X Using Face ID

We are seeing a flood of videos on YouTube from iPhone users who have gotten their hands on the new iPhone X and are trying to trick the Face ID. When my wife and I received our iPhone X, we had no such intention. However, things changed right after we were done setting up our new iPhones on November 3rd. We were sitting down in our bedroom and were just done setting up the Face IDs, our 10-year-old son walked in anxious to get his hands on the new iPhone X. Right away my wife declared that he was not going to access her phone. Acting exactly as a kid would do when asked to not do something, he picked up her phone and with just a glance got right in. You can get more details of the whole event and further testing that we did, including a recorded demo, from Andy Greenberg’s article on WIRED.

Apparently, TrueDepth camera’s depth map of my wife’s face, which was created by projecting and analyzing over 30,000 dots, wasn’t accurate enough as it worked with my 10-year-old son. He doesn’t fall under the “twins” exception and has a big age difference compared to my wife. His face is smaller than my wife’s face and the geometry of their faces don’t match, at least to human eyes. Also, the additional neural network present in iPhone X that’s trained to spot and resist spoofing doesn’t work as intended in this scenario.

I would like to point out one of the questions posed to Tim Cook by Senator Al Franken after the Face ID was announced:

"What safeguards has Apple implemented to prevent the unlocking of the iPhone X when an individual other than the owner of the device holds it up to the owner's face?"

In a world where your smartphone knows more about you than your significant other and has access to pretty much all of the services that you use, the question asked above is of paramount significance. Like many other smartphones, iPhone has many security features built in such as encryption and data protection, network and app security, and numerous device and privacy controls. If all of the protection settings are used right, the biggest risk comes from someone having physical access to your phone. Once a malicious person has found a way to hack into your phone, even encrypted data can be accessed.

The security issues related to Face ID reported so far could only be exploited with physical access to the iPhone and a targeted attack that involves a significant amount of research and financial investment, not taking the issue of a family member’s resemblance into account. It remains to be seen how Apple would respond to all of the issues being reported by end users related to Face ID. The take away here is that we need to understand the limitation of a small mainstream consumer device such as a smartphone to provide true biometric security and adopt it with that awareness in mind.