【720p Archives】

20p Archivesfirst batch of shiny new iPhone Xs is slated to ship on November 3, and shortly thereafter the lucky few around the country will excitedly tear into their white Apple-branded boxes. And while many of those early adopters will immediately set up Face ID, they may want to slow their roll just the teeniest of bits.

Since Apple unveiled the face-scanning technology earlier this month, privacy advocates and security researchers have expressed concerns about both the tool itself and what happens to the data it gathers. In response, the Cupertino-based company has assured everyone that the system is mostly secure and that it presents no real privacy concerns. Unfortunately, the arguments aren't all that convincing — at least not in the way Apple hoped. Instead, the tech giant has managed to scare me off Face ID for good.

SEE ALSO: So how worried should we be about Apple's Face ID?

My aversion to what is billed as the latest and greatest is not some random knee-jerk response to Apple — I happily own an iPhone — but rather a decision based on the pieces of information the company has been willing to release. Looking at what we know, it's clear that Face ID makes a device less secure, opens you up in new ways to coercion, and sticks you with an unchangeable password that everyone knows.

It's a recipe for disaster, and one that I am all too happy to pass on.

Security

First, a look at the basic security of the thing. Apple claims that a random person has only a one-in-a million chance of being able to unlock your phone with his or her face. That statistic, however, has absolutely nothing to do with a hacker or criminal actively trying to trick the device. The company says it trained Face ID to be able to discern between mask replicas, photographs, and the flesh-and-blood real deal, but the supporting data has yet to be made available to the public.

Face-scanning tech is notoriously insecure, and even Apple's Phil Schiller copped to the fact that a password is better suited to protecting the sensitive stuff.

"There's no perfect system, not even biometric ones," he noted at the September 12 Apple event. "If you happen to have an evil twin, you really need to protect your [...] sensitive data with a passcode."

Original image has been replaced. Credit: Mashable

Essentially, Schiller is admitting Face ID can be tricked. This is not news to hackers. As soon as the phone hits the scene later this fall, you can bet security professionals will start ripping the tech apart. Time will tell if they're able to crack it, but the long arc of history bends toward vulnerabilities being found and exploited. Just ask Samsung.

When it comes to hackers versus smartphone manufacturers, my money will forever be on the former.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Law enforcement

The entire reason to lock a device is to keep other people out — whether those people are creeping family members, identity thieves, or (yes) the police. The thing about biometrics, however, is that courts can force you to unlock your phone with your thumbprint (and likely faceprint). That same logic doesn't apply to a numeric password, however.

Sure, according to Apple it's easy to quickly disable Face ID if you're made to give up your device. "If you don't stare at the phone, it won't unlock," Senior VP Craig Federighi wrote in an email to an interested developer. "Also, if you grip the buttons on both sides of the phone when you hand it over, it will temporarily disable FaceID."

Pretty neat, right? Simply disable Face ID before politely handing your smartphone over to the authorities and you're good to go! Yeah, that doesn't work in the real world. In actuality, phones are not politely requested by authority figures. Instead, they are frequently snatched out the hands of protesters, swiped from bedside tables in raids, and pulled out of the pockets of handcuffed marchers pinned facedown on the pavement.

Temporarily disabling a feature on your iPhone X likely won't be an option right when you need to do so the most.

Your face as your password

Let's face it: Passwords get leaked. It's often that we read about some huge breach that exposes databases of login credentials. But here's the thing: You can change your alphanumeric password. Changing your face, on the other hand, is significantly more difficult.

Why does this matter? Apple has assured us that Face ID only keeps a mathematical representation of your face on the device itself, not in some leaky cloud somewhere. Even so, with Face ID everyone will know exactly what your password is — there's no need for it to be exposed in the first place. If (or when) the security of the system does get compromised, there's not much you'll be able to do about it. You can of course shut off your phone's face-scanning tech, but then you — like me — will not be using Face ID.

The same argument could be made against Touch ID as well, but there's an important distinction between that tech and its soon-to-be replacement: It's a lot harder for bad actors to capture thumbprints from a distance (and you probably shouldn't be using Touch ID anyway).

Newer isn't always better

The executives at Apple would have you believe that Face ID is a revolutionary technology that perfectly blends ease of use and security. But we know that not to be true. First of all, the company reportedly isn't even sure Face ID is here to stay — it may return to Touch ID for future devices. That doesn't project confidence.

What's more, the demo failed on stage. While an Apple spokesperson has argued that the fact the iPhone X didn't unlock as intended was a good thing, it's a little difficult to take that point seriously.

“People were handling the device for the stage demo ahead of time and didn’t realize Face ID was trying to authenticate their face," the rep told Yahoo. "After failing a number of times, because they weren’t Craig [Federighi], the iPhone did what it was designed to do, which was to require his passcode."

Theres's a few things to unpack in that statement. The spokesperson is copping to the fact that the iPhone X frequently scans faces in search of a match. This semi "always on" nature of Face ID is a huge red flag for privacy experts. What's more, if even Apple employees can't figure out how to handle the phone without locking out their boss on the company's biggest day of the year then clearly there's a usability issue.

This, combined with the security and privacy one must forfeit in order to use the technology, is more than enough to turn me off to the supposed revolution that Face ID represents. A password, at its core, is supposed to protect your data from a wide range of threats while still being practical. The latest offering from Apple just doesn't cut it.

---

Featured Video For You

---

This guy spent 4 months building a headphone jack in his iPhone

---

Topics Apple Cybersecurity iPhone