Is face recognition a good security feature?

Question

I found that this guy uploaded some face recognition code with a comment that he'd like to use it "as a security feature". This got me thinking; is face recognition a valid security feature, or is it "cool", but not very effective way to secure something?

Answer 1

No, not really. At least not as primary form of authentication. Biometrics in general are not good for authentication, because:

• You leave them all over the place, and there is no way to avoid that.
• They cannot be changed in case of a breach.
• You need to add a high error tolerance as to not cause usability problems. These tolerances lead to false positives, even without attacks, and make attacks possible.

In practice, when implementing the algorithms, they usually have to balance between [false acceptance rate] and [false rejection rate]. This makes the efficiency of face recognition the lowest of all regarding the table. Its security is also lower than other biometric recognition system, especially compared to fingerprint scan.

— Your face is NOT your password, Face Authentication ByPassing Lenovo – Asus – Toshiba (2009)

I couldn't find a live demonstration for that paper, but here is one from a 31C3 talk about biometrics, which uses a simple picture, and can bypass required blinking. Here is an article from a person using a video to bypass a blinking requirement.

Here is a more recent paper using more modern approaches:

In this paper, we introduce a novel approach to bypass modern face authentication systems. More specifically, by leveraging a handful of pictures of the target user taken from social media, we show how to create realistic, textured, 3D facial models that undermine the security of widely used face authentication solutions.

[...]

In our opinion, it is highly unlikely that robust facial authentication systems will be able to operate using solely web/mobile camera input. Given the widespread nature of high-resolution personal online photos, today’s adversaries have a goldmine of information at their disposal for synthetically creating fake face data. Moreover, even if a system is able to robustly de- tect a certain type of attack - be it using a paper printout, a 3D-printed mask, or our proposed method - generalizing to all possible attacks will increase the possibility of false rejections and therefore limit the overall usability of the system.

— Virtual U: Defeating Face Liveness Detection by Building Virtual Models from Your Public Photos (2016)

Answer 2

It's useful as a "username"

We have a name for an authentication feature that cannot be easily changed and is occasionally shown to third parties - it's your account ID, user name, etc.

While you'd still want to use something else (e.g. a password) as the primary authentication feature, replacing the user ID with face recognition can make it more convenient (no need to enter anything) and more secure than the commonly used IDs such as user names or email addresses.

Answer 3

You tagged this with authentication, so I will answer from that perspective. (But as Aria points out in comments, it also has applications in surveillance.)

For face recognition to be a cool feature on Facebook it just needs to work most of the time. For it to be useful for authentication it needs to have a fail rate close to zero. Almost no false positives (even if it is a person that looks a lot like you, or someone is holding up a photograph or a 3D model of your face), and almost no false negatives (even if you lost a lot of weight or applied some make up). That is asking for a lot.

And like with all biometric authentication, you have the problem with embedding the key in your body. If you thought the bad guys cutting off your finger to get past the fingerprint scanner was bad, imagine what they would have to do to get your face...

Plus you can't change the shape of your face (short of plastic surgery) as easy as you can change a password or a physical key if it is compromised.

So this has all the problems of fingerprint readers, only much worse. It is a bad idea.

Answer 4

There have been some good answers provided already. Probably the key point is that it depends on your risk profile. In some situations, facial recognition may be convenient control which is adequately effective for that particular situation, but for many other situations you will need to include it with other controls before it will provide an adequate level of protection. For example, I might decide that facial recognition is fine on my home computer or it might be adequate for my screensaver lock, but it is not sufficient for an initial login or on my computer in the open plan office at work etc.

The other important point to note is that there is considerable variation in the accuracy and reliability of different facial recognition systems. For example, people have shown that many of the implementations on some lower end mobile devices have vary broad matching parameters which can easily be fooled by either a photo or someone who looks 'similar'.

As with nearly all security controls, questions like "Is X secure" are generally the wrong question. Security needs to be assessed within the target context. What your are seeking is an adequate balance between risk of a compromise and convenience. Once you have identified what controls are appropriate, you then need to assess how effective the implementation of the selected controls are. If you have assessed that in a specific situation, facial recognition would be appropriate, you then assess that the facial recognition solution implemented performs within acceptable parameters.

Answer 5

It depends on your definition of security. For example it is certainly can be used as a security feature if nobody knows about it and the cam hiddenly compares faces of men signing in with the faces bound to acc and warns men responsible for security about mismatches. But it is security through obscurity and if an attacker knows about it it will use simple or complicated means of bypassing s.a. showing a picture or wearing a facial mask. The same about fingerprints and iris scanners. Most of biometric stuff for authentication purposes works only in supervised setting when a men stands nearby and detects cheaters with his eyes, brain and experience, such as border control, street surveillance (if the ones wearing masks or avoiding cameras or behaving differrent are stopped by police) or profiling criminals. So for auth. purposes in unsuperwised setting it is only good to impress 5yr-old children.

Answer 6

No. One could simply replace the camera with a device responding with a video of the person's face. And you leave your face everywhere.

Or run the system in a VM and connect a virtual driver with data collected from a camera of your face.

Using this as the only security measure is highly insecure and should never be used. Maybe it would work well in a two-factor authentication scheme, but never alone.