Google to roll out update 'in the coming' months to fix Pixel 4 Face Unlock bypass
CNE
Google told ZDNet today that it plans to roll out an update "in the coming months" to address an issue in the Pixel 4's Face Unlock mechanism.
The issue was discovered last week by a BBC reporter testing the soon-to-be-launched Google Pixel 4 smartphone.
The phone included a new facial recognition system named Face Unlock. BBC's Chris Fox discovered that Face Unlock worked even when the user had their eyes shut.
Security experts were quick to point out that this could lead to abuse, with family members, significant others, or attackers unlocking devices while the owner was asleep or out cold.
To make matters worse, a leak in the previous weeks showed that the Face Unlock settings page included an option named "Require eyes to be open." The option was not included in Pixel 4 devices sent to reviewers and journalists ahead of the Pixel 4's official launch on October 24.
Proof, for those asking #madebygoogle #pixel4 pic.twitter.com/mBDJphVpfB
— Chris Fox (@thisisFoxx) October 15, 2019
But in an email to ZDNet, Google said it's working on an update to address this issue. In the meantime, the company recommends that users enable one of the alternative methods of securing Pixel devices, such as using PIN codes, passphrases, or unlock patterns.
The issue isn't likely to have a big impact on the Pixel 4's launch. As Google said, users can simply use another screen-locking method until a patch arrives in the coming months.
Google full statement is below:
We've been working on an option for users to require their eyes to be open to unlock the phone, which will be delivered in a software update in the coming months. In the meantime, if any Pixel 4 users are concerned that someone may take their phone and try to unlock it while their eyes are closed, they can activate a security feature that requires a pin, pattern or password for the next unlock. Pixel 4 face unlock meets the security requirements as a strong biometric, and can be used for payments and app authentication, including banking apps. It is resilient against invalid unlock attempts via other means, like with masks.