There's been so much effusion and so much FUD written about Face ID, Apple's new biometric facial identity sensor — for iPhone X that it's been hard to sort fact from fiction. Apple did a pretty good job setting expectations at the September event but there's never enough time to cover everything. I've spent the better part of a month finding out everything I could on Face ID, and the last three days using it constantly. In general, it works so quickly and effortlessly it can seem like magic. But there are several situations where it doesn't work at all and that magic shatters.
Here's what you need to know!
December 22, 2019: Face ID can't authorize family purchases
Face ID currently can't be used to authorize family purchases on iPhone X. That's when a child account asks for permission to buy something on the App Store, iTunes Store, or iBooks Store, and a notification is sent to the parent's phone for approval. Although this has been the case since launch, it hasn't been widely reported until now.
Ars Technica pegs the attention on the holidays. More
Parents of large families with several children, each of whom might have an iOS device available to them, will find that the requests mount up quite quickly—especially right after the holidays. Kids cashing in App Store gift cards add to the requests already coming in from normal use and in-app purchases in games.
It's not surprising, given that children under 13 typically lack the distinguishing features Face ID relies on, and close family members are harder to differentiate than strangers. Face ID is also brand new and uses a training rather than simple binary compare model for authentication.
Put all those things together and securing family purchases is a greater challenge than first-party purchases.
Still, it's absolutely Apple's problem to solve and I hope the company solves it soon.
Face ID does not work in landscape orientation
As currently implemented, Face ID only works when you're holding your iPhone X in portrait orientation with the TrueDepth camera system on top. You can be standing up or lying down, seated or rolled over on your side, but the TrueDepth camera system has to be lined up in the same direction. Perpendicular and upside down don't play.
Face ID needs to be able to see your eyes, nose, and mouth
The facial geometry matched by Face ID includes your eyes, nose, and mouth. Face ID needs to be able to see them to function. If too much of that area is blocked, Face ID can't recognize you. That includes sunglasses with infrared (IR) filtering and face wear that blocks IR over a large amount of your mouth and nose.
You can turn off attention awareness to get around the IR-blocking sunglasses, at the expense of some security, and you can pull down opaque scarfs and neck warmers to temporarily expose your nose and mouth. (Facial hair isn't an issue.)
Practically speaking, it's like gloves and Touch ID. You can't block what the biometrics are trying to scan.
Strong, direct sunlight can blind the Face ID camera
If the sun is high and bright, and you're standing with it directly over your shoulder at an angle where it hits the TrueDepth camera, it can prevent Face ID from working. It's the same way any sufficiently strong light can blind any camera.
You can angle your iPhone X and/or your face away from the sun to work around it.
Practically speaking, it's like moisture on your finger and Touch ID. You can't blind or distort the camera trying to scan your features.
Young kids may not be distinct enough for Face ID to match
If you're under the age of 13, your facial features may not yet be distinct enough for Face ID to function properly and you'll have to revert to your passcode.
Evil twins can sometimes fool Face ID.
Face ID can't effectively distinguish between some identical twins (or triplets, etc.) It depends on what, if any, distinguishing facial geometry your doppelganger has developed over time. It's hard to know for sure until you test it, but if you have an evil twin (or triplet, etc.) and you don't want them to access your iPhone X, you'll have to disable Face ID and use your Passcode.
Face ID is limited to just one face
Touch ID was a simple scan-and-match system that could handle up to 5 separate fingers. Face ID is a complex neural network system that, as of version 1.0, can only handle one individual face.
Training Face ID to sort between multiple authorized people while still rejecting unauthorized people, and the many edge cases that introduces, will take a lot more time and effort. (If it's something Apple chooses to do — the number of people who registered multiple fingers is reportedly very, very low.)
With attention mode turned on, you really need to look at your iPhone X for Face ID to work
The biggest problem some people will have with Face ID is that, by default, it requires "attention". You really have to look at your phone to unlock it. Not think you're looking at it. Not kind of look at it. Really eye-of-the-tiger look at it. The problem with attention-aware interface is that you absolutely have to be paying attention.
Also, if you pick up your iPhone to move it around and it sees your face when you're not looking at it and not intending to unlock it, Face ID can still fire. If that happens five times, it'll go into secure mode and you'll need to enter your passcode to re-enable it. if you don't realize what happened, it can make you think Face ID simply stopped working.
Face ID, like Touch ID, can lock down
Face ID is also like Touch ID in that there are several situations where it will lock down and require a passcode before it can be re-enabled. Those include:
- After a reboot.
- After a remote lock (for example, through Find my iPhone.)
- After SOS mode has been triggered (by holding down the side but and either volume button for 2 seconds.)
- After having been locked for more than 48 hours.
- After five failed attempts to match face data.
- If the passcode hasn't been used in the last 156 hours and Face ID hasn't been used in the last 4 hours.
Going into SOS mode is the absolute best way to prevent someone else from trying to use Face ID on you to unlock your phone. Intention detection is the subtler and more persistent way. If someone else takes your phone, turn your head and close your eyes. Then, just like they'd have to force your finger onto Touch ID, they'd have to force your eyes open for Face ID.
That should alleviate much of the fear, uncertainty, and doubt (FUD) being spread about Face ID making it easier for criminals or law enforcement to get into our devices.
Face ID, like all biometrics, is more about identity than security
Security is always at war with convenience. Biometrics, including Face ID and Touch ID, are about making authentication much more convenient while maintaining a high enough level of security.
For people who require higher levels of security, a strong, unique password remains a better option than any biometric convenience on the market.
Other than that...
While limited, Face ID is still incredibly impressive. I've only been using it for a few days and already it makes Touch ID seem like a chore. You lift up your iPhone X, swipe up, and you're in. You tap a secure app and you're in. Look at a message, watch it unfurl, tap it and read it all. Just know that it has its limitations. That way you can make an informed choice about getting it and have a much better experience using it.
