SoylentNews is people
SoylentNews
from the dead-sure-that-it-shouldn't-do-that dept.
Submitted via IRC for SoyCow1984
Pixel 4's 'Face Unlock' works even if you're asleep or dead -- and that's a problem
Google's new Pixel 4 smartphone doesn't have a fingerprint sensor. Instead it relies on "Face Unlock," a proprietary facial scanning system similar to the one found in Apple's Face ID. Early reports show a system that works well, perhaps too well, in fact, according to some security experts.
To unlock a Pixel, the operator must hold it up to their face while onboard cameras and sensors go to work scanning their mug for defining characteristics — the distance between your eyes, for example. Once the device is confident it's you, it unlocks and allows you to access the operating system.
With Google's system, according to the BBC, the Pixel's Face Unlock function works even if a user's eyes are closed, a clear and security risk for anyone with a Pixel 4. Using default settings, users who are asleep, or even dead, could unknowingly unlock their phone for others.
According to Google representatives, "Pixel 4 Face Unlock meets the security requirements as a strong biometric." True, but this in and of itself might not be enough. At its launch, Pixel product manager Sherry Lin said, "There are actually only two face [authorization] solutions that meet the bar for being super-secure. So, you know, for payments, that level — it's ours and Apple's."
(Score: 2) by Rosco P. Coltrane on Sunday October 20 2019, @01:38PM (2 children)
People who are asleep might get pissed off. Personally though, I'm more worried that this feature also works with a mugshot...
(Score: 0) by Anonymous Coward on Sunday October 20 2019, @02:25PM (1 child)
Relatives of a dead man might care that sensitive data remains unavailable to outsiders, though.
(Score: 0) by Anonymous Coward on Monday October 21 2019, @12:51AM
Perhaps, but handling things like this isn't something that the law allows for the time being. There is no way of safely storing the log in information to permit retrieval by authorized parties and not by unauthorized ones. This apparently, allows access for the family members and anybody else with access to the body. Which could suck for criminal coconspirators or if there's embarrassing things on there, but also means that personal things aren't lost.
It's unfortunate that there's likely never going to be a way of handling these accounts so that they're only accessed after death for purposes that the deceased agreed to that doesn't also allow law enforcement to abuse access.