Show HN: Face IO – Facial Authentication for the Web(faceio.net)
faceio.net
Show HN: Face IO – Facial Authentication for the Web
https://faceio.net
19 comments
Sigh. How many times does it have to be stated: facial recognition is not authoritative! Using facial recognition for authentication is flat out wrong, a face image is too game-able, and to make it strong enough not to be spoof-able the in-system expected users will be rejected when they undergo ordinary human facial variation.
I was principal engineer of a leading enterprise FR system through 3 generations of the product, and I have global patents in the technology. This application of FR is flat out wrong and probably illegally fraudulent, because these people must know this technology cannot do what they claim!
I was principal engineer of a leading enterprise FR system through 3 generations of the product, and I have global patents in the technology. This application of FR is flat out wrong and probably illegally fraudulent, because these people must know this technology cannot do what they claim!
Hi. Congratulations on the launch.
I'm sorry in advance, this is going to be incredibly negative. I'll sum it up to this: WTF?
What's the motivation to build and launch this? Simplify authentication (it won't)? Make it more secure (it won't)? Make it cheaper (it won't)?
Your terms (https://pixlab.io/terms) are ridiculous. You might be the first SaaS I see that has both a "business-critical" tier and a "no warranty" clause in their terms.
Your "GDPR compliant" terms are out of whack, actually, too. Has a lawyer reviewed this? It's written for end users with no mention of customers or data processing agreements. You don't even have a DPO.
I'm doubly shocked because this looks like a lot of work and care has been put into this; what you built is a prototype at best, yet you're basically screaming that this is an enterprise-ready product you're fully launching.
I'm sorry in advance, this is going to be incredibly negative. I'll sum it up to this: WTF?
What's the motivation to build and launch this? Simplify authentication (it won't)? Make it more secure (it won't)? Make it cheaper (it won't)?
Your terms (https://pixlab.io/terms) are ridiculous. You might be the first SaaS I see that has both a "business-critical" tier and a "no warranty" clause in their terms.
Your "GDPR compliant" terms are out of whack, actually, too. Has a lawyer reviewed this? It's written for end users with no mention of customers or data processing agreements. You don't even have a DPO.
I'm doubly shocked because this looks like a lot of work and care has been put into this; what you built is a prototype at best, yet you're basically screaming that this is an enterprise-ready product you're fully launching.
> We may revise our Terms, Conditions & Policies at any time by amending this page. You are expected to check this page from time to time to take notice of any changes we make, as they are legally binding on you.
My first thought on reading this: https://www.youtube.com/watch?v=3D8TEJtQRhw&ab_channel=Empir...
Oh, and the refund policy can be summed up by "get fucked".
Hard pass.
My first thought on reading this: https://www.youtube.com/watch?v=3D8TEJtQRhw&ab_channel=Empir...
Oh, and the refund policy can be summed up by "get fucked".
Hard pass.
I've actually looked at their terms (which is rare for services I have no intention of using) - wow, it's amazing what a clusterfuck it is.
With Apple and Google supporting FIDO passkeys very soon (https://9to5mac.com/2022/06/07/passkeys-passwordless-sign-in... and https://developers.google.com/identity/fido), why would anybody want to use anything else?
Why should we trust you with face data?
FACEIO itself (the service) including this Website, the fio.js facial authentication library, the Embedded Widget, the Rest API, the Console) does not store or handle biometrics nor even know anything about them. It is the responsibility of the selected facial recognition engine by the application owner (eg website or web application you use) to choose a cloud storage region or opt for on-premises deployment for storing biometrics hash.
I don’t see any mentions of what you define as “spoof-proof.” Are you performing a liveness check [0] ? Eg can I hold a picture up of someone else’s face, or commandeer the camera feed to play a video of my choosing?
[0] https://www.liveness.com/
[0] https://www.liveness.com/
Credential stuffing attacks are old news. Face stuffing attacks are the new hotness.
No independent pen test, no independent security audit or certification, no security standards certification. No thanks.
Symisc Systems (our parent company) is working with security partners on SOC 2 reporting and full ISO 27001 certification. You can deploy on-premises (https://faceio.net/on-premise) or use AWS Rekognition as your default facial recognition engine (https://faceio.net/facialid#facial-recognition-engine) for complete control over facial hashes.
So I just need a username and a photo of my victim for authentication?
Yes, but then you can authenticate as badassly as they do in these dystopian sci-fi movies! /s
More and more people are getting vigilant in handling and securing their data; this is a rather convenient method, but what makes this challenging is the fact that it can be a delicious target for cyber attackers, and if the company suffers a data breach, malicious actors can get a hold of everyone's identity. They can use it to steal their financial credentials and collect information about the user. Although passwordless authentication would be an excellent way to lessen the effects of cyberattacks, people would be skeptical about how this would turn out.
[deleted]
We are the core developers behind FACEIO (https://faceio.net), a product developed from scratch here at PixLab (https://pixlab.io) in the past few years.
FACEIO is a cross-browser, Cloud & On-Premise deployable, facial authentication framework, with a client-side JavaScript library (fio.js) that integrates seamlessly with any website or web application desiring to offer secure facial recognition experience to their users.
Put it simply, FACEIO is the easiest way to add passwordless authentication to web based applications. Simply implement fio.js on your website, and you will be able to instantly authenticate your existing users, and enroll new ones via Face Recognition using their computer Webcam or smartphone frontal camera on their favorite browser.
FACEIO works with regular Webcams or smartphones frontal camera on all modern browsers, does not require biometric sensors to be available on the client side, and works seemingly with all websites and web applications regardless of the underlying front-end JavaScript framework or server-side language or technology.
Implementing FACEIO is straightforward. Before so, you need to create a new application first on the FACEIO Console (https://console.faceio.net), and link this resource to your website or web application. The checklist below highlights the steps to follow for a smooth integration of fio.js on your site:
1. Create a new FACEIO application first: Follow the Application Wizard on the FACEIO Console to create your first application and link it to your website or web application.
2. Select a Facial Recognition Engine: Review Security & Privacy settings, Cloud or On-Premise deployment and customize the Widget look & feel, all done via the Application Wizard (https://console.faceio.net).
3. Add the fio.js library to your Website: Implement fio.js (https://faceio.net/getting-started), our facial recognition library on your website before rolling facial authentication to your audience...
4. Enroll & Authenticate your first used via the enroll() & authenticate() methods respectively, the only two exported methods from the fio.js library.
The details:
Each enrolled user on your website represented by its feature vector (biometrics hashes, mapped by the selected facial recognition engine), alongside with his Unique Facial ID (https://faceio.net/facialid), as well as, any metadata you have already linked to a particular user, is stored in a sand-boxed binary index called Application in the FACEIO jargon. Think of FACEIO Application as an isolated container of your users' data. Only your application with its encryption key can gain access to this index (features vectors & metadata). You can retrieve your encryption key via the Application Manager on the FACEIO Console.
You can create a new application via the FACEIO Console in a matter of minutes. This is easily done thanks to the Application Wizard. The wizard should automate the creation process for you. Usually, this involve inputting an application name, selecting a facial Recognition engine, reviewing security options, customizing the Widget layout, and so forth.
We have baked privacy and security directly into our infrastructure. We collect and store the minimum amount of personal information needed to authenticate users, and we back that up with intelligence-backed security monitoring. The underlying Facial Recognition Engines that FACEIO rely on such as PixLab Insight or AWS Rekognition only stores hash signatures of your facial features, a stream of meaningless floating point numbers anonymously, after your full explicit consent, and/or until you submits a removal request.
FACEIO itself (the service) including this Website, the fio.js facial authentication library, the Embedded Widget, the Rest API, the Console) does not store or handle biometrics nor even know anything about them. It is the responsibility of the selected facial recognition engine by the application owner (eg website or web application you use) to choose a cloud storage region or opt for on-premises deployment for storing biometrics hash.
Finally, The following tutorials, and guides should help you get started with FACEIO:
1.Getting Started Tutorial: Learn the fundamentals. Your first steps with FACEIO - https://faceio.net/getting-started.
2.Integration Guide: Learn how to implement fio.js, our facial recognition library on your website before rolling facial authentication to your audience - https://faceio.net/integration-guide
3.Developer Center: Code samples, documentation, support channels, and all the resources you need to implement FACEIO on your website - https://faceio.net/dev-guides
4. Trust Center: Learn how we handle your data securely and in compliance with privacy and legal requirements. - https://faceio.net/trust-center | https://faceio.net/apps-best-practice