If you want your authentication to be secure, put the factors in this order:

1. Start with something you have.

2. Then use something you know.

3. Only then provide something you are.

Biometrics, including the facial recognition on the iPhone X, work well as a final verification step. Used as the first factor, they can be turned against you without your consent.

The iPhone X and Its Biggest Weakness

The annual Apple event is among the most anticipated technology events in the world. In September 2017, the company revealed the iPhone X, one of the most advanced phones on the market. What wasn't so great about it was the facial recognition technology. I'm not talking about the work Apple put into making sure a printout of your face won't unlock the phone. Biometrics as a first authentication factor looks cool in movies, but in practice it opens up more vulnerabilities.

When Your Face Can Be Used Without Your Consent

As a prior military member, I have tremendous respect for law enforcement. Police usually undergo extensive training in conducting lawful searches and seizures, and under the Constitution there are circumstances where we have a reasonable expectation of privacy. Officers have full authority to conduct a lawful search incident to an arrest and to confiscate your phone, but they should get a warrant before searching it. The Supreme Court held as much in Riley v. California (2014). Still, in some circumstances police gain access to evidence or information through unlawful searches and seizures, whether from a procedural error or a myriad of other factors.

For example, a search could happen while you are unconscious or so impaired that you couldn't legally consent. In 2017, a Utah nurse became famous for refusing to allow a blood draw from an unconscious patient without a warrant. If an officer could unlock a suspect's phone just by pointing it at that person's face, would he pause to get a warrant first? Consumers shouldn't rely on security that could involuntarily waive their rights.

The Duress Problem

Facial recognition on the iPhone X opens the door to loopholes under duress, and to other authentication workarounds. Imagine being mugged, but instead of taking what's in your wallet, the mugger holds your phone up to your face to open your banking apps and transfer money. If you store any banking cards on your phone, that's a real concern. When a login requires something you know, you could instead enter a pre-specified duress code to trigger alarms and call for help.

Apple did build in safeguards. By default, Face ID requires you to look at the phone with your eyes open, and pressing and holding the side button and a volume button for two seconds temporarily disables it until you next enter your passcode. Those help. But they depend on the person under threat acting in time, and none of them quietly alerts anyone the way a duress code can.

Why Mobile Banking Raises the Stakes

Credit card transactions are usually easy to report as fraud and cancel. Debit card transactions and bank transfers are much harder to recover. That's one of my biggest concerns about mobile banking, and it goes beyond biometrics. In August 2017, Samsung and Bank of America announced a pilot of iris-scan login. It's exciting and new, but how can banks and other companies with millions of customers balance flexibility and convenience against security?

The Simple Rule

Ultimately, my real overall point is simple: avoid securing your devices in a way that can be used against you without your consent.

In general, biometrics make a great additional verification factor. They're terrible when used incorrectly, for example as the initial identification step. That step should always begin with something you have, then something only you know, and then, possibly, something you are. For the same principle applied to a smart lock, see Amazon's In-Home Delivery App: Why Fingerprint-First Isn't Secure. To see how biometrics fit into a login that starts with a device, read WWPass Key Adds Face ID & Biometric Login Support and explore WWPass MFA.

FAQ

Why is biometrics as a first authentication factor risky?
A face or fingerprint can be used without your active participation, for example while you are unconscious or when someone holds your phone up to your face. Something you know has to be provided deliberately, and it can support a duress code.

What is the right order for authentication factors?
Start with something you have, then something you know, and only then, if at all, something you are. Biometrics work best as an added verification step after identification.

Can Face ID be turned off quickly?
Yes, temporarily. Press and hold the side button and either volume button for two seconds, and Face ID won't unlock the phone until you next enter your passcode. By default it also requires you to look at the phone with your eyes open.

Do police need a warrant to search a phone?
In general, yes. In Riley v. California (2014), the Supreme Court held that police need a warrant to search the digital contents of a phone seized during an arrest, with narrow exceptions.

Did Bank of America launch iris scanning for its mobile app?
In August 2017, Bank of America and Samsung announced a pilot of iris-scan login, starting with the Galaxy S8. The original article described it as a release, but it began as a pilot.

What to Do Next

Want to learn more about which authentication method gives you the most security? Connect with us.