Daniel Miessler:
Imagine a similar handheld device from a superior alien race. Assuming they needed such an interface or display at all, they would simply handle their device normally and it would still allow them to perform sensitive actions.
To an unfamiliar observer it might seem like no authentication took place, like one could just pick up any device and start taking sensitive actions on their behalf. But in reality all of that functionality had just been removed from the workflow and done automatically. It’s security made invisible and effortless.
That’s what FaceID is, and why it represents such an improvement: it adds security while removing friction.
I like the analogy here. Touch ID focuses authentication on a physical act on a physical mechanism on the phone. Face ID is invisible.
Which is exactly why I don’t like FaceID. Its a passive authentication system, vs TouchID which is an active one.
What if someone holds my phone to my face, demanding that I unlock it? I’m assuming FaceID can still be deactivated by quick-pressing the power button 5x, or I can shut my eyes in that hypothetical scenario?
Stop. Please stop. FaceID is NOT a security feature. It’s a convenience feature. Answer me this. Which is easier to compromise? A 12 character complex password or someone holding your phone up to your face?