Apple iPhone X’s Face ID: How it works, security, privacy, and more

Apple iPhone X: Face ID is one major new feature of the new smartphone. (Image source: AP)

Apple iPhone X (iPhone 10) will go on sale from November 3. In India, the starting price for iPhone X will be Rs 89,000. One of the highlights of the Apple iPhone X is that it doesn’t have TouchID, instead it comes with Face ID. This is a new form of biometric recognition to unlock the device. Like the Samsung Galaxy Note 8, S8 series, the iPhone X will recognise a user’s face and unlock the iPhone.

But how secure is Face ID on Apple iPhone X? How will Apple deal with privacy issues when it comes to storing such information? The company had put out a detailed paper explaining the security features with Apple Face ID in September this year. Here’s a detailed look at some questions and answers around Apple iPhone X’s Face ID feature.

Read: Apple iPhone X’s FaceID feature can be fooled, but still works well

Apple iPhone X: What exactly is Face ID and how does it work? 

Face ID relies on a bunch of hardware including a TrueDepth Camera, Infrared Camera, Dot Projector, and Flood Illuminator for recognising a user’s face. The Dot Projector projects more than 30,000 invisible dots onto a user’s face to build their facial map. The Infrared camera then reads the dot pattern and captures an infrared image, which it then sends to the "Secure Enclave in the A11 Bionic chip" to confirm the face and match it against stored data.

The Flood Illuminator relies on invisible infrared light to identify the face even when the iPhone X is being used in dark. All of this of hardware on the front ‘notch’ works together with the TrueDepth camera in order to recognise a user’s face and unlock the iPhone X.

Apple’s claim is Face ID will just work, no matter what the conditions; whether a user is wearing a hat or scarves, glasses or switching to contact lenses or wearing sunglasses, using it indoors or outdoors or even in total darkness. However, some early reviews point out it does have trouble working in bright sunlight.

Setting up Face ID on Apple iPhone X.

What are the other features of Face ID on Apple iPhone X? 

According to Apple’s white paper on Face ID security, the feature relies on the direction of a user’s gaze, and uses "neural networks for matching and anti-spoofing" to unlock the iPhone with a glance. It also claims the feature can "adapts to changes" in a user’s appearance, so even if you grow a beard or put on makeup to transform yourself, Face ID is still supposed to work accurately.

When setting up Face ID, a user will also need to create a passcode, so that in case this fails, the iPhone X can be unlocked using the code. Apple says users won’t have to enter the passcode so often with the Face ID and claims it is accurate in recognising faces. Finally, Apple Face ID can also be used to make payments via Apple Pay, though a user has to authorise this feature.

Facial Data is stored in the "Secure Enclave" of Apple iPhone X’s A11 Bionic chip.

What are the security features of Apple’s Face ID on iPhone X? 

Apple says "the probability that a random person in the population could look at your iPhone X and unlock it using Face ID is approximately 1 in 1,000,000 (versus 1 in 50,000 for Touch ID). " That’s a tall security claim to make, and we’re going to see this one tested in the coming days. Face ID allows only five unsuccessful match attempts, after which a user will have to enter the passcode to unlock the device.

Apple says Face ID is secure against physical and digital spoofing. So even if someone manages to create a 3D mask of your face, the iPhone X can’t be unlocked using this. The phone can’t be unlocked with a simple 2D picture of the user either.

Finally, the Facial Data is stored in the "Secure Enclave" of Apple iPhone X’s A11 Bionic chip, and it is stored as a "mathematical representation." So when the feature is used, the two representations are compared for a match. Apple’s security white paper says, "This enrolled facial data is itself a mathematical representation of your face captured across a variety of poses."

Also read: Apple iPhone X with FaceID: How to setup, how it works and everything else

According to Apple’s paper, they are not really storing the face images used during unlock operations, which are discarded once the mathematical representation has been created for comparison with the saved data. Apple’s says the Security Enclave is encrypted and only one face data can be stored on the iPhone X at a time.

How does Face ID match a face with the stored data? 

Apple says it is relying on neural networks which have been designed, trained just for this purpose. "We developed the facial matching neural  networks using over a billion images, including IR and depth images collected in studies conducted with the participants' informed consent," reads the paper.

Apple also says they don’t store Face ID data on their servers and that it doesn’t leave the device in question. This means all the computing around Face ID is done on the device itself. Apple’s paper says, the "data doesn't leave your device, and is never backed up to iCloud or anywhere else. Only in the case that you wish to provide Face ID diagnostic data to AppleCare for support will this information be transferred from your device." 

This process requires a "digitally signed authorization from Apple" itself so this won’t be applicable to most users unless they sign up for this. Also users have the option of reviewing the data being shared with Apple.

Apple iPhone X unboxing, first impressions: The most premium iPhone till date

Apple iPhone X’s Face ID can’t be spoofed with 3D masks or photographs, claims the company.

When can false matches take place in Apple’s Face ID? 

According to the paper, the possibility of a false match is higher when twins are involved for Face ID. Also siblings that look like similar increase the possibility for this kind of error. Finally in children under the age of 13, there are chances of a false match. According to Apple, this is because in children’s case "distinct facial features may not have fully developed."

So really how secure is Apple’s Face ID on iPhone X? 

For now Apple is claiming a system, which cannot be fooled. This is also one that is smart enough to understand and track changes in a user’s appearance over time and still ensure the iPhone X will unlock. It will also work in all sorts of lighting conditions, though early reviews point this is not the case. Of course, like all new forms of biometric authentication Apple’s Face ID will be subject to tests and scrutiny of the hacker community and users as well in order to see if it lives up to the claims.