OnePlus 6's Face Unlock Can be Fooled by a Photo, Surprising No One

By Tom Pritchard on at

In recent years there's been an increase in face-based biometric security on phones, from Samsung's Iris Scanner to FaceID and other face-centric unlock systems. It's also been proven many times that these systems can be beaten in various ways, especially the lower-tech varieties that rely solely on the camera. According to some testing the OnePlus 6 is no different.

Twitter user @rikvduijn claims to have beaten the phone's face unlock system by having someone else hold a picture of his own face in front of the camera. While we don't get to see the phone actually unlock up close, it's not actually a surprising development.

Face unlock systems aren't known for their security, and it's been known for a while that people can usually get round them provided they have a high quality picture of the owner's face or eyes. Even Apple's FaceID can apparently be beaten, though the infra red and 3D sensors naturally make it much harder (and more ridiculous) to accomplish. But then again most companies don't claim Face Unlocking is a secure feature, OnePlus included, and have made it clear it's designed for convenience. This is what OnePlus has said on the topic:

“We designed Face Unlock around convenience, and while we took corresponding measures to optimise its security we always recommended you use a password/PIN/fingerprint for security. For this reason Face Unlock is not enabled for any secure apps such as banking or payments. We’re constantly working to improve all of our technology, including Face Unlock.”

The only company that does big up the security aspect of face unlocking is Apple, thanks to the iPhone X's 3D mapping features. That's why the company is comfortable letting it be used to authenticate Apple Pay payments in place of the missing TouchID. Other phones don't have those features (at least not yet), and as such don't make those security claims.

So that's worth bearing in mind if you just got a OnePlus 6, or any other Android phone with a similar system. That Face Unlock isn't as secure as you'd like it to be. [Slashgear]