Is the Pixel 4's Face Unlock secure?

Best answer: Google claims only two face unlocking solutions are "super-secure" and they are Apple's Face ID and the Pixel 4's Face Unlock. This is true because of the unique hardware in each and how it's used, but you also need to know the limitations before you trust it 100% with all of your data.

• The phone that knows your face: Google Pixel 4 XL ($900 at Amazon)

Security versus convenience

Biometrics — using a part of your body to register who you are — have become commonplace on our phones. Almost every phone has a fingerprint scanning solution and most of us are familiar with them and how they work, but recent improvements in technology have brought secure facial unlocking to our handhelds. Secure is the key word here, and it means that special hardware and software is used to make the chances that someone else can spoof your face very slim. This is different than the face unlocking solutions we've seen in the past that use the camera.

But how secure is it really? The Pixel 4's Face Unlock is almost instant and has a high rate of success with fewer chances for false positives. That's because of the hardware being used.

A special sensor emits infrared light over your face and a second special sensor grabs image data from about where that light intersects with facial features like bone structure or nose position. This is stored in a secure chip inside the phone and when you try to unlock your phone using your face, the process is repeated. If the data matches what is stored it passes. If not, it fails.

This isn't using a picture of your face and that's why it's very difficult to fool. It's what makes it secure, maybe even more secure than using a fingerprint, but there are limitations about what it can do and how it does it, and you need to know them.

The eyes have it

Google gives the following warnings about Face Unlock on its help website:

• Looking at your phone can unlock it even when you don't intend to.
• Your phone can be unlocked by someone who looks a lot like you, like an identical sibling.
• Your phone can also be unlocked by someone else if it's held up to your face, even if your eyes are closed. Keep your phone in a safe place, like your front pocket or handbag. To prepare for unsafe situations, learn how to turn on lockdown.

The first two are simple common-sense warnings, but unlocking with your eyes closed is something to keep in mind. That means someone can unlock your phone using your face even if you are sleeping and it's a bit surprising to see Google allowing that to happen, especially since Apple's Face ID doesn't work that way. Interestingly, it's also different that early leaked versions of the software that did have a setting to require open and alert (read: not 100% stationary) eyes to unlock your phone using Face Unlock.

It's suspected that this feature was removed to make sure Face Unlock is fast and more accurate if you casually grab your phone and glance at it or is a feature that might return in a future update. Nobody knows for sure, but we can say you should never count on an update to fix something you don't like when buying an expensive phone. If the lack of an eyes-open setting bothers you and you don't care to use lockdown mode, you should think twice before using the feature or even buying the Pixel 4.

So is it secure?

Yes. It's as secure as advertised and as good as using your fingerprints (which also works when you're asleep). It could be made better with a requirement to force you to look at the phone or even blink when using it, but Google chooses to not use those.

Biometrics have a set of drawbacks when used as a security method but the convenience of using them outweighs the drawbacks for most people and they have become a popular way to secure a phone. In the end, more people locking their phones is better, even if the method they are using isn't the best way to do it.

That's where Face Unlock on the Pixel 4 falls — it's a pretty good way to lock your phone as long as you know what it can and can't do. It's not perfect, but it's a lot better than not locking your phone or using something like 1234 as a passcode for banking apps or password managers.