Giving the Pixel 4 an 'eyes open' Face Unlock setting is more placebo than precaution

The internet loves to find something to latch onto and create a controversy. I can say this with authority because I'm part of the internet just like you, and I love a good controversy, too. Controversy creates headlines and makes for an interesting read and it's simple human nature to think that everything has a bad side that we're not being told. Oftentimes, that's true. Other times, it's not. What really matters is that we can discuss a thing to death until we're done talking about it because a new controversy appears on the horizon.
This is one of those controversies.
More: Is the Pixel 4's Face Unlock secure?
The lack of an "eyes open" option on the Pixel 4's Face Unlock is this week's issue. Some feel that omitting such a crucial setting is a tech sin and the Pixel 4's security is lessened by its omission. Others think it's no big deal because there are plenty of other ways to lock down your phone. What do I think? I think adding it won't make a bit of damn difference because it's been shown to be a useless setting, but if that's what it takes to make people feel better then Google needs to get it in there pronto. Which is what it is doing.
Researchers Demonstrated Method for Bypassing Face ID on an 'Unconscious' Victim's iPhone Using Glasses and Tape https://t.co/VKFjVvjO9y - During the Black Hat USA conference in Las Vegas, researchers demonstrated a Face ID bypass method that used glasse… pic.twitter.com/mTxtkUOLJUResearchers Demonstrated Method for Bypassing Face ID on an 'Unconscious' Victim's iPhone Using Glasses and Tape https://t.co/VKFjVvjO9y - During the Black Hat USA conference in Las Vegas, researchers demonstrated a Face ID bypass method that used glasse… pic.twitter.com/mTxtkUOLJU— Dr Vicente Nario (@DrBicentenario) August 9, 2019August 9, 2019
Apple's Face ID has an option to force your eyes to be open to authenticate (you can also choose to turn it off). Other companies, like Samsung, OnePlus and Huawei, need your eyes to be open in order for their 3D face recognition to work to unlock your phone, but that doesn't matter because both still use photo-based recognition system instead of actual infrared bump mapping to build a data set of your face. Huawei does something that's using sensors and AI, but the company isn't telling exactly what it is, though it says you shouldn't use it in bright light or low light (opens in new tab).
The point of all of this is simple: unlocking your phone with your face isn't as much about security as it is convenience. It falls into what I like to call a zone of "secure enough," and like fingerprint sensors — which do not magically stop working when you fall asleep or put too many chemicals into your body — almost any secured face unlocking feature is "secure enough" but not absolutely foolproof.
What is absolutely secure? Nothing, though a password so long and convoluted that it would take a cluster of very fancy computer years to crack is a good start. Screw that though, because typing it every time is something nobody is willing to do. That brings us full circle and back to "secure enough."
Nothing is secure. But some things can be secure enough, which is what really matters.
Even the best facial unlocking feature or fingerprint reader is easily defeated if you have the right materials and the right set of circumstances. A resin-based 3D print of your fingertips will defeat any reader, and a well-crafted latex mask will defeat even enterprise-grade face unlocking. But that means someone has to really want to get into your phone and have access to your fingerprints or a high-resolution photo of your face, and then have physical access to your phone. If you're not able to trust the people around you then you shouldn't be using biometrics and should follow Google's advice and enable the lockdown setting during those times.
If you lose your phone on the bus or someone steals your bag and gets your phone, what are the chances that the person will have a photo of your face or know how to get one? Or find out where you live so they can hold it up to your face while you sleep? Or heaven forbid chop your finger off Mafia-style so they can unlock your phone? Zero. Exactly zero in all cases.
If your friends will unlock your phone while you're asleep or passed out, they aren't your friends.
More relevant is what can happen during a robbery. It's not something pleasant to think about, but people are robbed of their belongings every day. Just like a robber is able to force you to place your finger on a sensor, they can force you to open your eyes. They can also force you to enter your password, so again, we're back at square one where almost any locking feature is secure enough.
What you need to consider is locking your phone so someone can't grab it and rifle through your stuff while you're in the restroom or in the kitchen grabbing a drink. If a friend or family member is going to sneak into your room at night and unlock your phone while you're asleep, they can just bring a pair of sunglasses with tape on the lens as a backup solution. But that doesn't mean Google shouldn't add the 'awareness' feature — its job is to make us feel better about using its products, and that's what this will do.
Whenever it's released.
Google Pixel 4 XL
This is easily Google's best-ever phone. The hardware is sleek and efficient, and Android 10 runs brilliantly. Google's additions to the software set it apart, face unlock works incredibly well, and this is the best Android camera available. But the battery life is frustratingly bad, and it's hard not to feel short-changed paying this much for weak RAM and storage.
- $900 at Amazon (opens in new tab)
- $899 at Walmart (opens in new tab)
Get the Android Central Newsletter
Instant access to breaking news, the hottest reviews, great deals and helpful tips.
Jerry is an amateur woodworker and struggling shade tree mechanic. There's nothing he can't take apart, but many things he can't reassemble. You'll find him writing and speaking his loud opinion on Android Central and occasionally on Twitter.
-
Releasing their face unlock by forgetting or not including that your eyes need to be open for their face unlock authentication is a big failure on Google's part. Amongst other failures /disappointments with the Pixel 4 phones is not including their back fingerprint sensor. I thought Google was all about choice but it's pretty clear they re just following Apple's direction.
-
You absolutely have choice. Use a password or buy another phone.
-
I meant on their phone. I know you have so many other Android manufacturers to choose from.
-
You should reread (or actually read) this article.
-
I'm assuming you can't read and understand things
-
Sensible article, Jerry. I’m glad someone is making sense in all this chaos.
-
As an security feature the Pixel 4 will run out of battery before you are finished 3d-printing fingertips and facemasks so it is protected by your pin after reboot 😈
-
I just love how every reviewer for the iPhone X told everyone, "but look you can turn attention off and it'll make face ID faster!" And now it's like omg Google's face unlock is so insecure!
-
It's about having the option dude.
Just like iPhone users want the option of unlocking straight into the phone rather than the compulsory swipe up -
My guess is the writer too used to shamesung device. Huawei mate 20 and 30 as well as iPhone x and more recent to a 3d map using infrared pico projector (about 50000 point on your face in 3d) so nope not all OEM are like shamesung using a camera. Pixel use a Radar to 3d scan your face so is also not a camera.
-
Shamesung? Lol, shame on you
-
Infrared light and visible light are both light. Infrared does not make a scanning system more secure, it just makes it more usable under varying lighting conditions. Google and Apple use infrared emitters, but it should be noted that a system using visible light can be just as secure. That brings HTC into the picture, who has more experience in 3D imaging than Google or Apple. Each of the three systems require the same effort to bypass: a full face mask, with the Pixel 4 being a little easier to bypass than Apple or HTC because you don't need eyes or attention. The difference in systems is that some (like Samsung for example) use flat biometrics that measure distances between features on your face, and some use a 3D data map with depth information. It's far easier to lift a fingerprint and use tape and adhesives than it is to make an accurate 3D face mask, so I would say there is a difference in the level of security. That being said, I agree with Jerry completely that if you want real security, you won't use biometrics. The whole "eyes open" issue is relevant to me, not because of friends, but because we have a houseguest with a daughter who WOULD unlock my phone while I sleep if she could. Nothing like waking up to find a girl in your bed AND on your phone, and she's got her feet up on you while she watches movies!
-
Dude! What is YOUR deal with HTC? Please I'm really really curious. 🤣🤣🤣