Unlocking a phone by looking at the screen is one of the simplest authentication methods on modern phones; but the similar appearance of this process does not mean that iPhones and Android phones use the same technology. The main difference is that some systems use depth information for face recognition, while others analyze only a two-dimensional image of the user’s face.
How does Face ID work?
Apple first introduced Face ID with the iPhone X. This technology relies on the TrueDepth camera system on the front of the device and uses infrared light and depth data to create three-dimensional information of the user’s face. For this reason, Face ID does not merely look for similarity between two two-dimensional images, but also considers the structure and depth of the face in the authentication process.
One consequence of this approach is that a printed image or a two-dimensional digital photo lacks the depth information required by Face ID and cannot easily substitute for the real face. Apple has also stated that Face ID data, including the mathematical representation of the face, is encrypted and protected with a key that is only accessible to the Secure Enclave.
In addition to unlocking the phone, Face ID is used for authentication in apps and for confirming some purchases and payments. The system also has attention detection and can check whether the user is actually looking at the display; a feature that adds another layer of security to the unlocking process.
Apple states that the probability of a random person unlocking an iPhone with a registered face is less than one in a million. The company also emphasizes that this probability can be higher for twins and very similar siblings.
Why isn’t face recognition the same on Android?
In the Android ecosystem, one cannot assume a single technology for all phones. Many budget and mid-range models use the front camera to capture a two-dimensional image of the face and then software analyzes this image to verify the user’s identity. The lack of real depth information can make such systems more vulnerable to two-dimensional photos.
Which? tests have also shown that this problem is not merely theoretical. Since October 2022, the organization has tested 208 phones and in 133 cases, equivalent to 64 percent, the face recognition system could be fooled with a printed two-dimensional photo in their labs.
Of course, this statistic does not mean all Android phones are insecure. Some models use more advanced biometric systems and their security level is not comparable to the two-dimensional face recognition of budget phones. For example, Google in the Pixel 8 series and newer models has enabled Face Unlock for authentication in apps and for confirming purchases.
In fact, Android does not have a single face recognition technology and the security level of this feature depends on the hardware and implementation of each phone. Google even requires biometrics with specific security levels for some sensitive use cases; for example, Google Wallet requires Class 3 biometrics or methods like a PIN and password to confirm payments.
According to BGR, the main difference between the two approaches is the use of depth information; Face ID was designed from the start for three-dimensional authentication, whereas some Android systems rely solely on the camera image.
Therefore, when comparing the security of face recognition on iPhone and Android, the operating system name alone is not an appropriate criterion. The most important factor is the biometric technology used in the phone itself. If a device uses a depth sensor and anti-spoofing mechanisms, face recognition can be suitable for sensitive uses; but in simple two-dimensional systems, using a fingerprint, PIN, or a strong password can be a more reliable option for protecting sensitive information.