What is Face ID and what does it mean for financial services?

What is Face ID and what does it mean for financial services?

By Ben Callis, Senior iOS Consultant at Waracle | 20th September 2017

Face ID is the talk of the town since Apple’s iPhone X announcement.  Is it really more secure?  Will people adopt it to the same rate they have with Touch ID?   Can my customers identity be stolen?  What implications will it have for the development of financial services apps? Is it worth the cost?  

We’ll try and answer many of these questions and more in this blog, although we might leave out the ‘is it worth it’ as that battle is sure to rage on like it does every time Apple announces a new device with new features.   

What is facial recognition and Face ID?

Facial recognition is a computer application capable of identifying or verifying a person from a digital image by extracting landmarks or features from the subjects face.  It may, for example, analyse position, size, shape of the nose, eyes, cheekbones and jaw.   Face ID is a facial recognition system designed and released by Apple.  A 3D image of your face is created when the TrueDepth camera on the iPhoneX projects 30,000 invisible dots onto your face to build up the contours of your unique face.   If a match is found within the iPhone X’s A11 Bionic processor chip your phone will be unlocked and ready for business.  

This facial recognition feature of the new iPhone X is designed to replace Touch ID as the new de facto biometric authentication system.  While it is limited to the iPhone X at this time, Apple proposes it is the future of how we will unlock our smartphones.   

Why Face ID and why now?

Since the iPhone 5s Touch ID has transformed the way an iOS device is unlocked using a fingerprint sensor in the Home Button.   As Phil Schiller, Apple’s Marketing Chief, added during the launch “Touch ID became the gold standard in consumer device biometric protection” and though Apple weren’t the first to deploy fingerprint identification they have been instrumental in getting mass usability.   Apple have long talked about their vision to have an iPhone that is entirely screen, the introduction of Face ID will jump the iPhone X forward without the need to add a fingerprint sensor and therein destroy the aesthetics of the design.

Will Face ID offer me greater security for my phone and data?

Apple suggested that there is a 1 in 50,000 chance that someone would be able to open your phone with a fingerprint versus a 1 in 1,000,000 chance with Face ID.  Impressive stats but what is actually the likelihood of a person with the same or so closely similar characteristics as you having access to your phone?  Maybe, as Apple suggested if you had an evil twin.   The issue is, could a thief steal your identity and access your phone?   Well for a start let’s dismiss the thought of someone capturing your image while you are asleep as your eyes need to be open (however with a Flood illuminator in the TrueDepth camera Face ID can work in the dark and is said to be able to recognise you with a hat on, glasses or even if you grew a beard).   

Apple claims that Face ID cannot be tricked by photo’s, videos or any other 2D image, to be recognised the face must be measured in 3D.  So what about if someone has your phone and purposely points it at your face with the malicious intent of getting access to your phone and or your financial information?   Despite all the claims of if you don’t look at the phone directly or if you grip the buttons on both sides of the phone when you hand it over (which will disable Face ID) I’m guessing if this someone was also being very aggressive or holding a gun to your head you’d do what they ask, no phone is worth that for – not even an iPhone X!   

Face ID does allow users to opt out, just like Touch ID did.   Leaked firmware from iOS 11 shows the option to disallow Face ID logins, even if your face is already enrolled.  It’s not a perfect solution, but it’s as good as Touch ID was, and should give privacy-conscious users a way to address their concerns without avoiding the iPhone X entirely.

After 2 failed face recognition attempts the user is locked out of the biometric authentication and asked for a passcode.  This is similar to the method with Touch ID however this locks out users after 5 failed attempts.   Notably this is what happened when Apple first showed Face ID on stage.   

“The bio-lockout that I experienced on stage would require several interacts by other people with your phone (where they woke up the phone). For those of us who have been living on the iPhone X over the last months this has never been a real problem (hence my shock when it happened to me on stage! :-)”  

Craig Federighi SVP Software Engineering at Apple.

Could my face leak or get stolen?

The face data won’t be sent to the cloud or be accessible by applications on the phone.  As Phil Schiller said “Your face data’s protected with a secure enclave…the process is done on iPhone X and not sent to a server”.   This is the same as for Touch ID. For Touch ID Apple uses the enrolled fingerprint to create a hashed version of the data, which is then stored on the phone’s Secure Enclave security chip.

What does this mean for financial services mobile apps?

Imagine someone else manages to get access to your phone and authenticate into a banking app via Face ID and proceeds to try and take money out of your account into  theirs.   As with most banking apps with need to add a new account as a payee (unless they are your friends which is a different matter).    Some banks do not allow adding new payees on mobile for this very reason.   Other banks that allow the addition of payee accounts should require additional/re-authentication to add a new payee (e.g. Face ID, passwords, OTP via email).   Waracle would recommend the second approach.  Some banking apps may do re-authentication with a OTP sent in a text to the mobile number which is clearly less secure as it is basically sending the user the password.

What are the implication of Face ID to my existing app?

If you have an app that uses Touch ID for authentication then Face ID will “just work”. Many apps that use Touch ID are likely to have text in their app which directly refers to Touch ID or fingerprint biometrics. To avoid confusion prior to the iPhone X launching any such references should be updated to be more generic or be based of the devices supported biometric type (LABiometryType).

A new enumeration LABiometryType has been added to LocalAuthentication allowing you to identify programmatically the types of biometric authentication the device supports.

Currently it is not possible to secure items in the keychain with just Face ID. This will likely be added in the future (perhaps even before the iPhone X launches). It is possible to secure items in the keychain with TouchID (e.g. we can use touchIDAny to constrain access to an item with Touch ID for any enrolled fingers) so there is no reason to believe that support for Face ID secured keychain items will not come shortly (keep an eye on Apple Developer Documentation for any updates here).

Face ID and Touch ID – 5 Key Biometric Design Guidelines

  1. Whenever possible, support biometric authentication. Face ID and Touch ID are secure, familiar authentication methods that people trust. If a user has enabled biometric authentication, you can assume they understand how it works, appreciate its convenience, and prefer to use it whenever possible. Bear in mind that people may choose to disable biometric authentication on their device, so your app should be prepared to handle this scenario.
  2. Initiate authentication only in response to user action. An explicit action, like tapping a button, ensures that the user wants to authenticate. In the case of Face ID, it also improves the likelihood the user is facing the camera.
  3. Always identify the authentication method. A button for signing into your app using Face ID, for example, should be titled “Sign-In with Face ID” rather than “Sign-In”.
  4. Reference authentication methods accurately. Don’t reference Touch ID on a device that supports Face ID. Conversely, don’t reference Face ID on a device that supports Touch ID. Check the device’s capabilities and use the appropriate terminology. For developer guidance, see LABiometryType.
  5. Don’t use custom icons to identify system authentication features. When people see icons that look like the system’s Touch ID (thumbprint) and Face ID icons, they think they’re supposed to authenticate. Custom variants of these icons create inconsistency and cause confusion, especially when colorized, displayed at a large size, and presented out of context—like as a button label or on an app’s Settings screen.

Get your apps ready for Face ID now

It’s not entirely new technology but Apple’s latest announcement will certainly push it more mainstream than it has ever been. Other suppliers will naturally follow suit, issues will be found and dealt with and the technology will continue to mature, at a much greater pace.   Considering how this will impact your own mobile app development plans now and building any changes into your plans will be key to making the most of the surge of enthusiasm that will soon follow.  If you want to find out more about Face ID and the implications for building a new mobile app or to plan modifications for your existing app contact Waracle today.

Latest Blog Posts

Want to know more...