iPhone X Face ID Fooled on Video, Fails to Identify Between Mother and Son

While Face ID, Apple’s native facial recognition technology, is one of the key compelling features of the iPhone X, it seems to have some loopholes. Some security researchers have already claimed to have fooled Face ID with 3D-printed masks. And now, a mother and her 10-year-old son show how Face ID can be fooled, failing to secure the experience between family members.

At the time of unveiling the iPhone X with the absence of Touch ID back in September, Apple claimed that the probability of unlocking the phone using Face ID is one in 1,000,000 as opposed to fingerprint detecting Touch ID at one in 50,000. However, the company explicitly admitted that the chances of breaking Face ID security increase with siblings, twins, and children under the age of 13, by publishing a security white paper. In it, Apple admits Face ID may fail with children below the age of 13 “because their distinct facial features may not have fully developed.”

This is what a new video shows that features Sana Sherwani and her kid Ammar Malik. The 41-second-long video shows that the kid was easily able to unlock the iPhone X of Sherwani – there is some visible family resemblance, but some rather distinct facial features as well.

Attaullah Malik, the husband of Sherwani, pointed out some flaws in a LinkedIn post that led his son to unlock the iPhone X of his wife. “Apparently, TrueDepth camera’s depth map of my wife’s face, which was created by projecting and analysing over 30,000 dots, wasn’t accurate enough as it worked with my 10-year-old son. He doesn’t fall under the ‘twins’ exception and has a big age difference compared to my wife. His face is smaller than my wife’s face, and the geometry of their faces don’t match, at least to human eyes,” writes Malik, who works as a director of technology operations at Taskstream.

If in case Face ID doesn’t recognise a face, it presents a passcode input to users. If the failed scan passed a certain threshold of resemblance, and the passcode is inputted correctly thereafter, Face ID takes another scan to correct its model in the attempt to be more accurate in the future. Apple in its security white paper says this “augmentation process” for its Face ID model is to “keep up with dramatic changes in your facial hair or makeup use, while minimising false acceptance. However, Malik claims this wasn’t the case with his wife and son, and no-one entered the passcode after Face ID rejected a scan, Wired reports.

Although family members can be an exception in case of protecting the iPhone X using Face ID, a group of Vietnamese researchers recently claimed that they had fooled the same authentication system using a composite 3D-printed mask. Apple assured users at the iPhone X launch that Face ID can differentiate masks and real human faces. But the researchers’ team at security firm Bkav allegedly proved that assurance wrong through a mask that cost $150 (approximately Rs. 9,800) to make.