Threatpost, via 9to5Mac:
Researchers on Wednesday during Black Hat USA 2019 demonstrated an attack that allowed them to bypass a victim’s FaceID and log into their phone simply by putting a pair of modified glasses on their face. By merely placing tape carefully over the lenses of a pair glasses and placing them on the victim’s face the researchers demonstrated how they could bypass Apple’s FaceID in a specific scenario. The attack itself is difficult, given the bad actor would need to figure out how to put the glasses on an unconscious victim without waking them up.
Obviously, this is a very slim scenario, requiring an unconscious victim. But it does raise the specter of law enforcement rendering someone unconscious in order to break into their phone.
I like a typed in password because you can’t be compelled to give it.
I also like plugged in charging which is 40% more efficient than induction.
My kid once did this to me when I was napping using TouchID Luckily (mostly for him) it was to get a free app, not to spend a fortune on IAP.
Would be very easy to do this on someone passed out drunk. You see college pranks with people waking up with shaved eyebrows or sharpie all over their face. You think they are going to wake up if someone puts glasses on them?
Curious if this would have been a $1 million bug thing if they had waited 24 hours?
Of course, if it was a fingerprint sensor, it’d be trivial to press a deeply unconscious person’s finger to the phone.