Apple has released a white paper explaining the Face ID facial recognition technology on the iPhone X. The paper answers several questions about security and privacy about the Face ID and also explains how the new system works.
First up, Apple says Face ID doesn’t capture your entire image and the face scans are stored locally on the device.” Once it confirms the presence of an attentive face, the TrueDepth camera projects and reads over 30,000 infrared dots to form a depth map of the face, along with a 2D infrared image. This data is used to create a sequence of 2D images and depth maps, which are digitally signed and sent to the Secure Enclave”, Apple said in the white paper.
Face ID adapts to changes in appearance, and the document gives a bit more info on that topic. If there is a major change in appearance, like the disappearance of a full beard or a significant haircut, Apple will require a passcode and then update the stored facial data accordingly once your identity is confirmed.
“Third-party apps can use system-provided APIs to ask the user to authenticate using Face ID or a passcode, and apps that support Touch ID automatically support Face ID without any changes,” notes the document. “When using Face ID, the app is notified only as to whether the authentication was successful; it can’t access Face ID or the data associated with the enrolled face.”
To improve unlock performance and keep pace with the natural changes of your face and look, Face ID augments its stored mathematical representation over time. Upon successful unlock, Face ID may use the newly calculated mathematical representation—if its quality is sufficient—for a finite number of additional unlocks before that data is discarded. Conversely, if Face ID fails to recognize you, but the match quality is higher than a certain threshold and you immediately follow the failure by entering your passcode, Face ID takes another capture and augments its enrolled Face ID data with the newly calculated mathematical representation.