diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn about the technology and security implications regarding Apple's FaceID.



**TL;DR:** There's still lots to learn from FaceID, but Apple has set the tone for how other tech companies should address user privacy and security concerns. Read on to learn about the security and implications for FaceID.

---

## Is FaceID Really Secure?

When Apple unveiled the new iPhone X earlier this month, the shocking [price tag](http://www.businessinsider.com/apple-iphone-x-prices-around-the-world-2017-9) wasn't the only thing to get attention. On its list of [innovative features](https://www.wired.com/2017/09/everything-apple-announced-at-its-2017-iphone-event/), one has garnered more attention than the others.

We're talking about FaceID. It's part of the new era of biometric technology aimed at making device logins unique based on physical characteristics—in this case, FaceID lets users unlock their phones just by looking at them.

But despite the convenience it offers, users are wary. They get that biometrics are more sophisticated now but don't understand the long-term implications for their security and privacy. Because their face is their password, they want to know what companies are doing to safeguard against hacks.

With that in mind, what can you do to protect your users' information? And what can you do to educate them on how your system works? Here at Auth0, we live and breath security so here's a breakdown of what you can do.

## How Apple is Innovating Facial Recognition

Biometrics have become more sophisticated in a way that consumers are having a hard time understanding. They understand that a face or fingerprint scan verifies their identity—[30%] (http://www.b-secur.com/the-increasing-popularity-of-biometric-authentication/) of mobile phones use a fingerprint scanner to unlock them—but what isn't clear is how it works.

With the iPhone X, Apple is taking a stab at explaining how the tech works and how it protects users. At the unveiling, Apple went into detail about how the new feature works. They presented a demo of it in action and spoke to the concerns users have regarding things like privacy and security. They showed that they were aware of the concerns and indicated what they had done to protect their users.

The demo explained that the phone combines an infrared camera with a flood illuminator, proximity sensor, ambient light sensor, camera, and dot projector to let users unlock their phones, download apps, and make payments via Apple Pay.

![Apple presenting iPhone X with FaceID technology](https://images.ctfassets.net/23aumh6u8s0i/4KFYbK4qXenRIcyGuSrECN/ef33f94d580b6a3ce8e184cffc75ed40/face)
_[Source](https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/)_

This combination—called TrueDepth—is touted as the latest step to securing personal data. The thinking is, other than an identical twin, users' faces are all different. Meaning, even though they're a walking password, no one else has the power to unlock their phone and access the information stored within it.

The technology works by using deep learning and facial mapping to recognize the user's identity and then confirm it. Specifically:

1. When a user holds the phone up to their face, the flood illuminator auto detects their face—even in the dark.
2. Then the infrared camera logs an image of their face.
3. The dot projector kicks in and produces 30,000 invisible dots that represent their facial structure.
4. Finally, the infrared image and the dot pattern go through Apple's neural networks and create the mathematical equivalent of their face. This is the image the phone uses to compare against the one logged at setup.

For all of this to work, the user has to have their eyes open and looking at the camera.

Apple isn't the first tech company to use facial recognition on a mobile device. But unlike the others that have been fooled into unlocking based on [a picture of the user](http://www.businessinsider.com/samsung-galaxy-s8-facial-recognition-is-a-security-flaw-2017-4), Apple assures users that FaceID is harder to crack. The chance of one user looking at someone else's phone and unlocking it is one in a million.

## Manage Growing Pains to Optimize Safe Usability

Things that have users running to social media to vent their worries range from hacks like 3D face recognition to data used to track their every move. Let's take a closer look at the facts and weed out the fiction to see if these concerns do pose a real threat.

### 3D Facial Recognition

With facial recognition, the main concern is how easy it could be to fool facial recognition software. For example, how easy would it be for one user to hold up a picture of another user or wear a mask of someone else's face to get access?

The idea of printing 3D images of peoples faces and then using them to hack into their phones is strictly theoretical right now. No one has done it, but it might be possible to confuse a piece of hardware into thinking that a living, breathing person is looking into the camera. Users are worried that at some point in the near future, these printouts could be used to unlock phones and get access to personal information.

![Apple presenting 3D facial recognition for FaceID](https://images.ctfassets.net/23aumh6u8s0i/1uUuKLvuSLEHWXfKthxImZ/95e2fa3fc142cae91e3ce4457faa6a1f/image)
_[Source](https://techcrunch.com/2017/09/12/face-id-is-replacing-touch-id-on-the-new-iphone-x/)_

Even though SR Labs in Berlin was able to make a plaster mold of someone's head to hack into Microsoft's Hello facial recognition system, TrueDepth makes tricking FaceID really hard. For starters, the sensors and camera capture the contour and shape of users' faces. After running their own tests, Apple is confident that it would be incredibly hard to replicate that experiment with FaceID.

To build trust in your users, take a similar approach and test user theories and concerns on your hardware. Then share the results with your users. In Apple's case, the tests offered clarification on just how complex TrueDepth is and what makes it so hard to beat. The more secure you can show your product to be, the more likely users are to entrust their security to you.

<include src="TweetQuote" quoteText="To build trust in your users, take a similar approach and test user theories and concerns on your hardware."/>

### Mass Public Scans to Identify People

People are constantly looking at their phones which makes it possible for mass scans to monitor them—if that were allowed. Users are concerned that if that happens, their profiles—including name, location, and habits—can be shared with other companies or authorities without their knowledge. This would [make them](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) “vulnerable to other facial-recognition systems with fewer security and privacy protections."

Meaning, if users are scanned while they're looking at their phone and then their name and location are shared with other businesses that don't have the same experience managing data as the original company, their data will be at risk in case of a breach or hack. No one wants to walk around with [anti-surveillance makeup](https://www.theatlantic.com/technology/archive/2014/07/makeup/374929/), so you have to find a way to show your users why their fears are unfounded.

You need to be clear about how you manage data so explain things like the following to your users:

* What triggers the camera. Do your users have to do something or are cameras on all the time?
* How the scanned data is stored. Will it be stored on servers or the device? Storage location gives a hint to how easy it is for people other than your users to access it.
* What the process is when governments, law enforcement, or other businesses ask for private information. Will you notify users and ask for permission or will you let them know after the fact that their information has been shared? Make this clear, so users know what to expect.

For Apple's part, they have to update their [transparency reports](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) and explain their policy in case they're asked to supply facial data or run scans. This keeps users informed on where their data can end up and flag potential concerns.

### Mass Surveillance by the Government to Track People

Platforms like Facebook that use facial recognition to tag people in pictures, don't control the [operating system that](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) "controls the cameras on phones, tablets, and laptops that stare at us every day." Companies like Apple control the devices. What makes the FaceID unique is that Apple controls the hardware, the operating system, and the features within it.

<include src="TweetQuote" quoteText="What makes the FaceID unique is that Apple controls the hardware, the operating system, and the features within it."/>

And because Apple has ownership, users are concerned that governments could issue an order asking Apple to dig into its data and share users' personal data with them. This already happens with [Upstream](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) in the States, where hundreds of millions of emails get tracked every year. In Australia, law-enforcement have the right to [monitor the browsing history](http://www.smh.com.au/technology/technology-news/data-retention-and-the-end-of-australians-digital-privacy-20150827-gj96kq.html) of people without asking for permission first. And UK intelligence agencies have access to email, social media messages, and web browsing messages.

![FaceID tool of mass surveillance](https://images.ctfassets.net/23aumh6u8s0i/462gelq1sJWBgdlPR96ydw/3a315e3fa6fdfa89b67b9181a7092d25/tweet)

As a result of this surveillance, users are concerned that face recognition is another way to access more personal information. They're flocking to platforms like Twitter to voice their opinion and educate other users on the issues.

Apple has always put its user privacy first, and they need to continue to publicly assert that as their modus operandi.

A good example is Apple's recent software update that prevents advertisers from following Safari users as they browse the web. Advertisers won't be able to track the sites users visit and then show relevant ads. Advertisers aren't pleased because [14.9%](https://www.theguardian.com/technology/2017/sep/18/apple-stopping-ads-follow-you-around-internet-sabotage-advertising-industry-ios-11-and-macos-high-sierra-safari-internet) of people on the internet use Safari. But from Apple's perspective, they're ensuring that users can browse with a level of anonymity.

Even when pushed by law enforcement to release sensitive information [relevant to prosecution](https://gizmodo.com/apple-wont-turn-over-your-phones-data-to-police-if-your-1636197341), Apple hasn't buckled to pressure. For example, iOS 8 phones and beyond are encrypted in a way that Apple can't crack user password. And if they can't crack them, they can't give law enforcement any information from a user's phone even when presented with a search warrant.

Just like Apple, it's in your best interest to put user privacy first so you can boost your users' trust.

### Forced Phone Unlocking

Biometrics are the future of security but are [easy to crack](http://www.complex.com/life/2016/12/kid-buys-250-dollars-pokemon-items-with-moms-thumbprint). This was the problem with TouchID; users can be forced to give their fingerprint to confirm their identity. However, the major difference is it's easy to cover your hands but that isn't the case with a face.

For example, people crossing the US border have the right to refuse requests from customs agents to access their phones. Without a password, there's little authorities can do to unlock devices. People control access to their private information.

But with this new tech, a customs agent only needs to hold up the user's phone to their face to unlock it. Beyond closing their eyes or looking away, there isn't much users can do to refuse. When a face is a password, people can't hide it or withhold it.

In order to make face scans a viable, long-term solution, tech companies should follow Apple's lead and make it about more than just scanning a face. FaceID measures the facial contour and lighting and has a proximity sensor to capture the nuances of different faces. Adding complexities like varying the amount of time users have to look in the camera or requiring voice recognition can give them the power to decide whether or not to comply with law enforcement.

So even if someone holds a phone to your users' face, that alone won't unlock it. And their right to privacy remains intact.

## What a Secure Future Looks Like

With the growth of the Internet of Things, there's the expectation that everything will be available immediately. FaceID caters to this need for immediacy, but Apple and other tech companies have to address the issues that matter most to users.

Here are examples of what tech companies should consider as they innovate new products:

* **Don't lock users into [one password option](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/).** Let them choose how they want to secure their data. For example, the iPhone 8 defaults to FaceID during setup, but users can press the home button five times to activate the PIN password option.
* **Use [2-factor authentication](https://auth0.com/learn/two-factor-authentication/).** Traditional 2-factor authentication uses a password paired with an auto-generated, random PIN. Biometric 2-factor authentication can instead use a face scan combined with a retinal scan or fingerprint to verify the user and add another layer of security. Since not all users take their data privacy [as seriously as they should](https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/), companies can help by making 2-factor authentication mandatory.
* **Limit where face recognition can be used,** especially until the kinks are worked out. For example, use it to unlock phones but not to make payments. Someone other than the user accessing private messages is intrusive, but a stranger accessing private financial information is damaging.
* **Store face scans locally, on devices.** Meaning even if there's a request for scanned data, it isn't available to the company to share. For an added layer of protection, companies can [encrypt the data with a key](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) that they don't have access to. This leaves users with power and ownership of their data and helps companies protect user privacy.

<include src="TweetQuote" quoteText="Don't lock users into one password option. Use MFA. Limit where face recognition can be used."/>

## Taking the Next Step

The future is now, and biometrics are the reality. Continued innovation means biometrics not only protect valuable information but also offer ease and convenience. We're still in the early days of this type of tech, so there's still a lot to learn.

What's important is finding ways to protect data and boost user confidence. It doesn't matter how cutting edge new technology is, if users don't trust it, it doesn't do any good.

Users can see the value biometrics offers, so you can ensure a positive experience by being vocal about the strides being made to protect data, how that data is being used and what standards they can expect. The more open they are with users, the better it is for them in the long-term.

Getting users to read terms and condition is one option. Because they don't always do that, send occasional notifications to their phones letting them know what you're doing. Instead of giving them all the information at once, look at it as a kind of drip campaign to gradually educate them on what you're doing and how important it is for them to do their part.

Get in the habit of talking about security with them to help shape their actions and trust your innovations.

<include src="asides/AboutAuth0" />


Is FaceID Really Secure?

The good, the bad, and the future of Biometric Identity.



If we have any hope of a future with all-around [passwordless, friction-free authentication, it will probably come at the hands of biometrics](https://auth0.com/passwordless).

A biometric identity is the unique physical features of your person that can be used to identify you. The classic example is fingerprints, which have been used to identify criminals since the 1800s. But now, much more than the fingerprint is used to identify people — for less sinister reasons than criminal identification.

And the future only promises more innovation in the field of biometric authentication. From gait analysis to the way you use a computer, biometric authentication still has plenty of room to grow.

## Biometrics of today

There are a large number of biometric options available today, some more used than others. Here's a quick rundown of what's in place and how they're generally used.

## Widely Used

The most widely used biometrics are generally used by the government or large companies to verify your identity. One popular application of biometrics is in border security, where it is used as a way to confirm someone's identity in addition to their passport. Banks and hospitals are also big users of biometrics, in part because they secure large amounts of sensitive data.

Of course, with facial and fingerprint recognition available in many smartphones and computers. Day-to-day, many consumers use biometric authentication habitually, whether it's unlocking one's phone or signing into an app.

Another huge use of biometrics is in law enforcement. While most people thankfully don't come up against this use, it is an extension of the government's ability to store large amounts of biometric data, which is important for its widespread adoption.

### Eyes: Iris or Retina Recognition

An individual may be identified by a scan of their eye, either looking for unique patterns in the iris or vein patterns in the retina. Both are unique to individuals and may be verified against a digital copy. The largest use of iris or retina recognition currently is by governments at border control or to verify benefits recipients. Smartphones with the capability to scan eyes have been released, but fingerprints remain much more common on personal devices.

![Retina recognition](https://images.ctfassets.net/23aumh6u8s0i/45NNDBOYwKZ7b1XbxoEAUs/75c3830e1f764eba131882fe38d6f1dc/iris)

([source](http://www.iritech.com/blog/iris-biometric-safe/))

### Face Recognition

Face recognition is made possible by taking features of the face (ex the distance between eyes) and using those to match a face stored in a database. There are many methods of analysis currently in use for accurate facial recognition, and the field is still developing. Face recognition is widely used by the US and other governments, is available for device login, and is also used by cameras and social sites to identify faces in photographs.

### Fingerprint Recognition
One of the most widely known ways to identify and individual biometrically is with their fingerprint. Everywhere from police stations to border control to your iPhone, you can be identified by the ridges and valleys on the tips of your fingers.

### Other Hand Recognitions
Fingerprints aren't the only unique features of the hand — anything from dimensions of fingers to vein patterns in the palm to a palmprint may be recorded and used to identify an individual. Other hand recognitions are not as common as fingerprints, but are gaining in popularity everywhere from the FBI to hospitals.

![Palm scan](https://images.ctfassets.net/23aumh6u8s0i/1Zj3Cb2vQedCEh04ByR9It/65e19f026a938dd153f7f4ea8bcc5f17/nyu-langone-patientsecure-palm-scan-620)

(Vein matching scan | [source](http://www.cbsnews.com/news/patientsecure-biometric-palm-scan-system-hospital-security/))

### DNA
DNA recognition is probably the only form of biometric authentication on this list that isn't easy to understand, because it relies on the isolation, copying and splitting of genetic markers in our DNA to identify us as an individual. Though widely used and very accurate, from court evidence to paternal testing to gene therapy, it doesn't have the immediacy needed to be used for something like border security.

## Emerging

There are some biometric technologies that are still being refined and implemented, but are already available for use. Among these, voice recognition may be the most widely available, especially in the financial sector, although the development of voice technology still leaves much to be desired.

It remains to be seen if these will become widely adopted, or pushed out of the way by newer technology. Either way, it's possible that you'll one day soon be able to be identified by the following:

### Typing Recognition
Already widely used by Norwegian financial firms, typing recognition identifies individual by their unique habits using a computer keyboard, from key pressure to rhythm of tapping. One company boasted a [99.7%](https://www.hottopics.ht/stories/consumer/dont-go-hacking-my-heart-10-startups-at-the-frontier-of-biometric-authentication/) success rate at distinguishing real and fake users.

### Ear Recognition
You may not know that the human ear is unique to every individual, for we are born with more or less the ear shape we'll have for the rest of our lives. While the technology for highly accurate ear recognition exists and is theoretically ready to use, applications of ear recognition are being refined and tested, and are still not widespread.

### Voice Recognition
From the sound of your voice to the cadence of your breath, voice recognition takes ~[100 datapoints](https://www.theguardian.com/technology/2016/feb/19/how-safe-is-voice-recognition-fingerprint-id-hsbc) from your speech to identify you as a unique individual. It is starting to be implemented in bank security and also by some governments.

## Biometrics of tomorrow

The future of biometrics is likely to try and move towards identifications that are easier and easier for users. Things like gait analysis don't take any real work on the part of the individual, like putting a finger or palm a scanner. They will rely on more powerful technological infrastructure becoming available in public areas, whether that's an easier way to read under-skin chips or better touchscreens for finger writing.

It is, of course, possible that these technologies won't be significantly better than the developments made in our current biometric authentication methods — but there's only one way to find out.

### Gait Analysis
An individual can be identified by a number of data points surrounding their gait, including speed and joint movements. Gait analysis is sometimes used for efficiency of motion in elite athletes, but people are still trying to figure out the best way to implement gait analysis for identification, and what the limits of its applications are.

### Body Modifications (Bodymod)
While certainly not adopted by the masses, people like PayPal's Jonathan Leblanc have [talked](https://www.hottopics.ht/stories/consumer/dont-go-hacking-my-heart-10-startups-at-the-frontier-of-biometric-authentication/) about bodymod as a way to attach unique identification to a person, rather than relying on their underlying biological identity. Could embedding, injecting, or ingesting technology could be the future of authentication? He's not the only one that thinks so — a senior BuzzFeed reporter got a chip implanted in his hand and successfully purchased goods by connecting it to a mobile paying app. Radical? Yes, but also possible.

![Gait analysis](https://images.ctfassets.net/23aumh6u8s0i/17cZlAxCWdOOtGSLq4uLfz/f4ab86a826e31ec15a13eb343b36a7d7/gait-analysis)

([source](https://www.buzzfeed.com/charliewarzel/yes-we-scan?utm_term=.ctLeR0e7ZZ#.hg09LO9Voo))

### Finger Writing
With repeated writing on a touch screen, computers can recognize a “signature” in your finger writing — your unique way of writing without a pen. This data could theoretically be stored and used in any number of ways. For example, instead of punching in a PIN number, you might write a phrase on a screen. Finger writing to date has been given an extremely high level of accuracy, with confidence up to [99.97%](http://resources.infosecinstitute.com/biometrics-todays-choice-future-authentication/#gref).

### Computer Interaction
Like typing recognition, computer interaction relies on the unique way an individual interacts with a computer, from typing speed to common spelling mistakes. It is currently [being developed](http://resources.infosecinstitute.com/biometrics-todays-choice-future-authentication/#gref) at West Point, but there are definitely civilian applications for the tech — imagine if you just had to write a quick email to get through customs or to apply for a visa.

## Are biometrics safe?

Biometrics *are* safe. There are a lot of hyperbolic fears about people who are worried that if they have a cold voice recognition won't work, or that people will be cutting off fingers to get around fingerprint scanners.

Well, remember those 100 datapoints that advanced voice recognition takes? They can determine you are you if you have a cold, and can even distinguish between voice imitators that sound so similar the human ear might confuse them for the same person.

Biometric authentication checks aren't 100% foolproof, but it shouldn't be cause for concern. Unfortunately, there are weaknesses for every system. The weaknesses in biometric systems certainly aren't any higher than those in a username + password system, which we rely on now.

Let's put it this way — nobody is going to make a 3D printed version of your face to fool a scanner, unless you're an *extremely* powerful public figure.

![3D Face Scan](https://images.ctfassets.net/23aumh6u8s0i/2XQianhjwIV5inXu5aqYe5/69cc8f85393509d707a1981fd75d28c4/3d-face)

(Source: [The Memo](http://www.thememo.com/2017/03/02/how-secure-is-your-face-the-worrying-world-of-biometrics/))

If you are a powerful figure, you might want to avoid a total reliance on biometrics to [configure a multifactor login](https://auth0.com/multifactor-authentication) with a complex, unique password and multiple devices involved in login.

Most people simply aren't going to be targets of biometric identity theft, especially as technology gets more sophisticated and takes more and more data into account when making identifications. As it is now, biometric authentication is probably better than having “1234567” or “0000” as your password, anyway.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## The bio-future

Biometric authentication clearly has a long way to go before we exhaust its possibilities. From government identification to healthcare to banking, from consumers unlocking their devices to evidence in a courtroom, where biometric authentication isn't the norm, it's likely to become the norm in the future.

With more development, we could sharply reduce the use of passwords, identification documents, and PIN numbers. Biometrics are here to stay — and the best part is that once they're in place, you might never have to remember any passwords again.


"biometric-identity"