Face unlock can easily be defeated with a photo on many popular phones, study finds

Face unlocking is nice, convenient and nearly ubiquitous these days, but is it safe?

According to a study conducted by the Dutch Consumers Association (via The Register), on (too) many phones it can easily be defeated with a printed photo of the owner.

The study tested 110 smartphones and was able to unlock 42 of them (though some of them were mere variants of the same models, i.e. Samsung Galaxy A8 with 32GB and 64GB of RAM) with a high-resolution photo of the owner. An additional 6 models (again, some are variants) also failed the test, but they did offer a stricter security setting for face recognition.

The list of devices that failed is quite an ugly one and includes numerous popular models such as Asus Zenfone 5, HTC U11+, Huawei P20 Pro, Motorola One, Nokia 7.1, Samsung Galaxy A8, Sony Xperia XZ3 and Xiaomi Mi A2. The full list of the phones that failed the test is below.

1. Alcatel 1X

2. Asus Zenfone 5 Lite 64 GB

3. Asus Zenfone 5, ZE620KL (64 GB)

4. BlackBerry Key2

5. BlackBerry Key2 (US version)

6. BQ Aquaris X2

7. BQ Aquaris X2 Pro

8. General Mobile GM8

9. HTC U11 +

10. Huawei P20 (EML - L29)

11. Huawei P20 Lite

12. Huawei P20 Pro (CLT - L29)

13. Lenovo Motorola Moto E5

14. Lenovo Motorola Moto E5 (BR version)

15. Lenovo Motorola Moto E5 Plus (BR version)

16. Lenovo Motorola Moto G6 Play

17. LG K9 (LM-X210EMW)

18. LG Q6 Alpha (LG-M700n)

19. Motorola Moto G6 Play (BR version)

20. Motorola One

21. Nokia 3.1

22. Nokia 3.1 (US version)

23. Nokia 7.1

24. Oukitel VU

25. Samsung Galaxy A7 (2018)

26. Samsung Galaxy A8 (32GB) (SM-A530F / DS

27. Samsung Galaxy A8 (64 GB)

28. Samsung Galaxy A8 + (SM-A730F)

29. Samsung Galaxy J8 Brasil

30. Sony Xperia L2 (H3311)

31. Sony Xperia L2 (H3321)

32. Sony Xperia XZ2 (H8216)

33. Sony Xperia XZ2 (US version)

34. Sony Xperia XZ2 Compact (H8314)

35. Sony Xperia XZ2 Compact (US version)

36. Sony Xperia XZ2 Compact Dual SIM (H8324)

37. Sony Xperia XZ2 Dual SIM (H8266)

38. Sony Xperia XZ2 Premium (US version)

39. Sony Xperia XZ3

40. Vodafone Smart N9

41. Xiaomi Mi A2

42. Xiaomi Mi A2 (32GB)

Notably, Apple's iPhone XR, iPhone XS and iPhone XS Max all passed the test.

It's slightly comforting that the latest flagships from major manufacturers, such as Huawei Mate 20 Pro, OnePlus 6, Oppo Find X, Samsung Galaxy Note 9 and Galaxy S9, all passed the test. The list is below.

1. Alcatel 3V (5099D)

2. Alcatel 5

3. Apple iPhone XR (128 GB)

4. Apple iPhone XR (256 GB)

5. Apple iPhone XR (64 GB)

6. Apple iPhone XS (256GB)

7. Apple iPhone XS (512GB)

8. Apple iPhone XS (64GB)

9. Apple iPhone XS Max (256GB)

10. Apple iPhone XS Max (512GB)

11. Apple iPhone XS Max (64GB)

12. Asus Zenfone Max Plus (ZB570TL)

13. Honor 10

14. Honor 7C

15. Honor 8X

16. Honor View 10

17. HTC U12 + (EU version)

18. HTC U12 + (US version) Huawei P Smart +

19. Huawei Y6 (2018) (ATU-L21)

20. Huawei Y7 (2018)

21. Huawei Mate 20

22. Huawei Mate 20 Lite

23. Huawei Mate 20 Pro

24. Lenovo Motorola Moto G6 (32GB)

25. Lenovo Motorola Moto G6 (64GB)

26. Lenovo Motorola Moto G6 (US version)

27. Lenovo Motorola Moto G6 Plus

28. Lenovo Motorola Moto Z3 .US version

29. Lenovo Motorola Moto Z3 Play

30. Lenovo Motorola Moto Z3 Play .US version

31. Motorola Moto G6 (BR version)

32. Motorola Moto G6 Plus (BR version)

33. One Plus 5T

34. OnePlus 6 (128GB)

35. OnePlus 6 (256GB)

36. OnePlus 6 (64GB)

37. OnePlus 6 (US version) (64 GB)

38. Oppo Find X

39. Samsung Galaxy A6 (32GB)

40. Samsung Galaxy A6 + (32GB)

41. Samsung Galaxy A6 + (64 GB)

42. Samsung Galaxy A9 (2018)

43. Samsung Galaxy J6 (2018)

44. Samsung Galaxy Note 9 (128 GB) (EU version)

45. Samsung Galaxy Note 9 (128 GB) Dual SIM (BR version)

46. Samsung Galaxy Note 9 (128 GB) Single SIM (EU version)

47. Samsung Galaxy Note 9 SM-N960U1 (US version)

48. Samsung Galaxy S9 (SM-G960F / DS)

49. Samsung Galaxy S9 SM-G960U1 (US model)

50. Samsung Galaxy S9 256GB

51. Samsung Galaxy S9 dual (128GB)

52. Samsung Galaxy S9 + (SM-G965F / DS)

53. Samsung Galaxy S9 + 256GB

54. Samsung Galaxy S9 + dual (128GB)

55. Samsung Galaxy S9 + Single SIM

56. Samsung Galaxy S9 + SM-G965U1 (US model)

57. WIKO View 2

LG's G7, V35 and V40 flagships, as well as Honor 7A, passed only with increased security settings.

Interestingly, when we tested a similar technique on the OnePlus 6 in May 2018, we were able to fool it, though it required a very specific scenario (the phone would only be fooled by a face printout if it were unlocked by the actual owner moments before). This indicates that, by using some slightly more advanced technique, the results might've been even worse.

The results are worrying. Researchers note that some of these phones will warn you that face recognition isn't the safest option for keeping the data on your smartphone private. But users should be aware that, in some cases, all it takes to unlock a phone is a printed photo of the owner.