Apple Shares Updated iOS Security Guide for Face ID, Apple Pay Cash and More

Apple today has shared a revised version of its iOS Security Guide on last Thursday, dated January 11, 2018. The new document, which comes in at 78 pages long includes new details and information that covers features introduced in iOS 11.1 and iOS 11.2, like Face ID and Apple Pay Cash, and more…

Much of the information in the document on Face ID has been previously shared by Apple in a dedicated Face ID white paper and accompanying support document that was released in last September following the iPhone X’s announcement. In the updated iOS security white paper, Apple also introduced features such as Shared memos, CloudKit and Siri recommendations, as well as how to ensure security.

Updated for iOS 11.2

• Apple Pay Cash

Updated for iOS 11.1

• Security Certifications and Programs
• Touch ID/Face ID
• Shared Notes
• CloudKit end-to-end encryption
• TLS
• Apple Pay, Paying with Apple Pay on the web
• Siri Suggestions
• Shared iPad

Apple writes that Face ID is meant to provide easy access to your device “within thoughtful boundaries and time constraints:

“This makes using a longer, more complex passcode far more practical because you don’t need to enter it as frequently. Touch ID and Face ID don’t replace your passcode, but provide easy access to your device within thoughtful boundaries and time constraints.

This is important because a strong passcode forms the foundation of your iOS device’s cryptographic protection.”

Apple also stresses a random person looking at your device and successfully using the face ID to unlock it is very unlikely, but it will be less accurate for siblings, twins, and young children.

“The probability that a random person in the population could look at your iPhone X and unlock it using Face ID is approximately 1 in 1,000,000 (versus
1 in 50,000 for Touch ID). For additional protection, both Touch ID and Face ID allow only five unsuccessful match attempts before a passcode is required to obtain access to your device.

With Face ID, the probability of a false match is different for twins and siblings that look like you as well as among children under the age of 13, because their distinct facial features may not have fully developed.”

The document also offers color on the security of iOS 11.2’s new Apple Pay Cash feature. Apple’s security team explains that Apple Payments Inc. will store and use transaction data for fraud protection and other basic purposes in some cases:

“Apple Payments Inc. will store and may use your transaction data for troubleshooting, fraud prevention, and regulatory purposes once a transaction is completed. The rest of Apple doesn’t know who you sent money to, received money from, or where you made a purchase with your Apple Pay Cash card.”

Read the full content of updated iOS security white paper in here, it’s pretty lengthy at 78 pages, so you may want to skip to the sections you’re most interested in.