which phone security can be bypassed?

Are your phone’s fingerprint and Face ID really more secure than your PIN? Check the pros and cons of biometrics.

Biometrics in a smartphone: what is it all about?

Biometric security on your phone is all methods that use specific characteristics of your body instead of a password:

• fingerprint,
• facial scan (Face ID and similar),
• someday maybe too iris scan Whether vascular system.

In theory, it sounds perfect: you won’t forget to “take” your finger or face with you from home. They also cannot be “lost” like a code or a piece of paper with a password. In practice, however, the differences between fingerprint, PIN and facial recognition are much more interesting – both in terms of security and convenience.

PIN, password, pattern – classic security

Let’s start with the simplest: PIN and password.

PIN/password gives you:

• possibility of setting very strong security (long PIN, alphanumeric password),
• full reversibility – you can always change the code if there is a risk that someone knows it,
• certain “legal neutrality” – PIN and password are information that in many situations you do not have to disclose, because you are protected by the right to defense. In turn, a fingerprint or face scan is a biometric sample, i.e. a feature of your body, which in certain situations the services may try to obtain as evidence rather than “a secret you are revealing.”

Weaknesses:

• people set PINs like 1111, 1234, dates of birth,
• The PIN can be viewed over the shoulder (so-called shoulder surfing),
• with too simple code, a brute force attack (multiple attempts) becomes real if the system does not have reasonable limits.

Fingerprint on the phone – how does it work and is it safer than a PIN?

The fingerprint reader on your phone does not store a “photo of your finger”. When registering a print, the system creates encrypted feature template (characteristic points of the line), which is kept in a separate, secured part of the smartphone system. The raw finger image does not come out of this secure module.

The biggest advantages of a fingerprint:

• very quick unlocking – usually 1 tap,
• works even when you have a mask / hat / glasses,
• makes it difficult to “see” the password,
• in combination with a PIN, it really increases security (because you enter the code less often, so someone can see it less often).

Disadvantages that are rarely talked about:

• you can “leave” an imprint on a glass, telephone, door handle – in theory it can be copied (with a lot of work),
• an injured, wet or cracked finger may suddenly stop working,
• in a situation of physical coercion someone can simply place your finger on the reader – does not need to know the PIN.

In practice, modern readers are very well designed, and the chance that someone will take the trouble to make a hyper-realistic imitation of your finger is small for an ordinary user. From an everyday safety point of view a fingerprint is usually more secure than a 4-digit PINbut loses to strong sloganif we are talking about the scenario of a “very advanced attack, consuming a lot of time and resources”.

Facial recognition – is it the “safest” option?

Not all “facial scans” work the same. It is worth remembering this in the context of safety.

• Face ID (Apple) i advanced 3D systems some Android smartphones use cameras and infrared projectors that create a three-dimensional map of the face. This is “high-end” biometrics.
• Simple “face unlock” in cheap smartphones is often based only on the analysis of the image from the front 2D camera – and such a system can be susceptible to fraud using photos or recordings.

Apple boasts that the probability of your iPhone being accidentally unlocked by another person (not counting your “twin”) is approximately 1 in 1,000,000while for Touch ID it was 1 in 50,000. This suggests that well-implemented 3D facial recognition can be statistically “more powerful” than fingerprinting.

However, Apple clearly states an important caveat: these statistics are based on random people in the population. The likelihood worsens significantly for twins, siblings with a similar appearance, and children under 13 years of age because their facial features may not be sufficiently developed. In such situations, Apple recommends additional security in the form of an access code. This means that while Face ID is statistically more secure for most users, its effectiveness may change depending on the anatomical characteristics of the user and those associated with them.

Advantages of facial recognition:

• extreme comfort – “you pick it up and look”,
• works with gloves / when your hands are full,
• in the 3D version it is resistant to ordinary photos and videos,
• in Face ID systems, facial data is stored locally, in a secure system – it does not go to the cloud.

Problems and limitations:

• cheap 2D face unlock solutions can be tricked with a photo,
• wearing a mask, balaclava or with a significant change in appearance, the effectiveness decreases,
• the same as with a print – in a situation of duress, someone can simply “show your face on the phone”.

Biometrics vs. PIN: what is “better” in real life?

The most honest answer is that combining biometrics with a strong PIN or password is ideal, rather than replacing one with the other. From the point of view of everyday use, biometrics – i.e. fingerprint or facial recognition – wins in terms of convenience. You unlock your phone with one touch or glance, you enter the code less often, so the risk of someone looking at your PIN over your shoulder decreases. In practice, it is biometrics that “handles” most unlocks during the day and makes security not burdensome.

However, your PIN or password remains your “last line of defense”. They are required after restarting the device, changing security settings or several unsuccessful biometric attempts. You can always change the code if you suspect that someone may have known it, and in many situations it is better protected by law than biometric data – you are not always obliged to disclose it.

So the key is not so much whether you choose fingerprint or face, but how strong your PIN is and how these methods work together. A set of 4-digit PIN “1234” plus a fingerprint gives a rather average level of security. In turn, a 6-digit (or longer) PIN, combined with a good fingerprint reader or Face ID, provides a very high level of protection for an ordinary user – without having to bother with constantly entering a long password.

When can biometrics be risky?

Although manufacturers promote fingerprint and Face ID as “super secure”, there are scenarios in which it is worth at least being aware of the risks:

• situations in which someone may use force – an officer, a violent partner, an attacker can simply grab your hand or face and put it to the phone; However, the PIN requires conscious provision of information;
• high risk countries/situations – when protecting confidential data (investigative journalists, activists, etc.), some organizations recommend turning off biometrics before crossing the border or demonstrating;
• children and shared use – biometrics are sometimes “divided”. Someone “adds” their finger or face “to make it more convenient”, which in practice means two equivalent keys. This is not always a safe option.

It is good practice conscious use of safe modes – iOS and Android allow you to quickly turn off biometrics (e.g. after several incorrect attempts, long press of the button, etc.), so that unlocking only requires a PIN.

What to choose: fingerprint, Face ID or PIN?

If I had to boil it down to a few practical tips:

• Don’t give up your PIN/password. Biometrics are a layer of convenience, not a replacement for code.
• Set a stronger PIN – at least 6 digits, preferably one that is not a date of birth or a repeating pattern.
• If you have a choice between “2D face unlock” and a fingerprint – choose fingerprint. Simple camera-based facial recognition is the least trustworthy.
• If you have Face ID / 3D recognition + PIN 6+ digits – for 99% of users this set is more than sufficient.
• Pay attention to your surroundings. If you know you may find yourself in a duress situation, consider temporarily turning off biometrics and sticking with your PIN.