Face Key

At a glance

• 0 strangers accepted out of 8,348 test photos
• 94% of the owner's sign-in attempts accepted (33 of 35)
• 4 face models, the same on every platform
• 4 factors per sign-in: face, email code, PIN, server part

Setting up Face Key

You set up Face Key in Settings → FaceKey on web, desktop or mobile, after agreeing to the biometric consent.

• Usual look: 5 captures.
• Variations (optional): with or without glasses, hair, headscarf, hat, makeup, or something else. 3 captures each.
• Looks: each look becomes its own Face Key. Up to 6 looks per setup and 8 Face Keys per account.
• PIN: your account PIN is asked once; the server then gives one 32-byte secret part per look.
• New device: a setup from a new device waits for approval from a device you already use. The new device shows a 2-digit number; on your trusted device you enter a 6-digit code sent by email and pick that number from 3 choices. 3 wrong tries deny the request.

Signing in

• Email code. You enter your email and receive a 6-digit code.
• Face. 3 captures, each through the photo checks. Frames that disagree with the others are dropped and the rest are combined. Your face stays on your device.
• PIN. The server checks it, then returns a single-use ticket and your Face Keys, each with its server part.
• Match. Your face is tried against each of your Face Keys. The one that opens gives the key to your vault and a login key, which the server checks together with the ticket.
• Signed in. Your vault opens without the master password. If your face matched only just, it is saved as an extra "learned" look and you are emailed.

Photo checks on every capture

A capture that fails a check is simply retaken. It never uses up a sign-in attempt.

• One face: What it makes sure of: Exactly one face is in the picture
• Head angle: What it makes sure of: Your head is held straight
• Lighting: What it makes sure of: Your face is bright enough, with no strong light behind you
• Live face: What it makes sure of: Two anti-spoofing models agree it is a live face, not a photo or a screen
• Eyes open: What it makes sure of: Your eyes are open
• Eyes covered: What it makes sure of: Your eyes aren't hidden, for example by sunglasses
• Mouth covered: What it makes sure of: Your mouth isn't hidden by a mask
• Not static (setup only): What it makes sure of: Your head or eyes move a little across a look's captures
• Same person (setup only): What it makes sure of: All captures of a setup are of the same person
• Not a duplicate (setup only): What it makes sure of: The same picture isn't used twice

What it runs on

Four face models, the same files on every platform. Only SFace decides who the person is; the others check the photo. Every app checks each file's SHA-256 before loading it.

All platforms produce exactly the same result from the same photo (0 differing bits in cross-platform tests), so a Face Key set up on one platform works on all of them.

• YuNet: Job: Finds the face and 5 points on it (eyes, nose, mouth corners); Source: OpenCV Zoo; Licence: MIT; Size: 230 KB
• MiniFASNet (two models): Job: Live face or photo / screen; Source: Minivision Silent-Face-Anti-Spoofing; Licence: Apache-2.0; Size: 2 × 1.7 MB
• FaceAttribNet: Job: Eyes open, sunglasses, mask; Source: Qualcomm AI Hub; Licence: BSD-3; Size: 43 MB
• SFace: Job: Identity: turns the aligned face into 128 numbers; Source: OpenCV Zoo; Licence: Apache-2.0; Size: 39 MB

Keys and encryption

Because of the server part, a stolen copy of our data plus a photo of you is not enough: in testing, 0 of 120,720 such attempts opened a Face Key.

• Face → bits: How it works: SFace turns your face into 128 numbers, which a fixed projection turns into 4,095 bits, identical on every platform
• Face half of the key: How it works: An error-correcting code (BCH) hides a random 98-bit secret. A face close enough to your look recovers it exactly; a face further away gets nothing
• Server part: How it works: Made with HMAC-SHA-256 and a server secret kept apart from the data it protects. Given out only after the email code and the PIN, and never stored
• Final keys: How it works: HKDF-SHA-256 over the face half and the server part gives an encryption key and a login key
• On the server: How it works: Only encrypted data (AES-GCM) and one-way hashes (SHA-256). No face, no template, no photo

Error rates

The closest "strangers" in every test were identical twins. The owner rate comes from one person's attempts.

• Wrong person accepted (face alone): Result: 0; Test: 8,348 photos of different people (LFW), about 16 million comparisons; even the closest stranger stayed outside the limit
• Owner accepted, looks set up by hand: Result: 30 / 35 (86%); Test: 35 real sign-in attempts by one person, 8 looks
• Owner accepted, with learned looks: Result: 33 / 35 (94%); Test: The same 35 attempts; about 6% need a retry
• Photo plus stolen data: Result: 0 / 120,720; Test: A stolen copy of our data and the owner's photo, without the server secret
• Difference between platforms: Result: 0 bits; Test: Server, web, extensions, desktop and mobile on the same photos

Limits and lockouts

• Face: 5 failed matches lock Face Key for 15 minutes, with a countdown, and the server enforces its own limit too. When your face isn't recognised, SyFly suggests adding a look with your password, for example if you're somewhere new or in different light.
• Email code: 5 tries, valid for 10 minutes, at most 5 codes per hour.
• PIN: 5 tries, then the account is locked for 15 minutes. Changing the PIN or removing Face Key needs your current PIN or your two-factor step.
• Learned looks: saved only after a full sign-in that matched only just; you are emailed and can remove them in Settings. At 8 Face Keys the oldest learned look is replaced, never one you set up by hand.

Privacy

• Your face is processed only on your device; no photo or face template is uploaded.
• Consent is asked before setup on every platform, and recorded.
• Face Key data is deleted when you remove Face Key or delete your account, and at the latest 3 years after you last used SyFly.
• Face Key data is never sold or shared.

Known limits

• The face alone may accept an identical twin; the email code, the PIN and the server part still stop them.
• Big changes in look, such as new glasses or very different light, may need an extra look.
• OpenCV does not state which dataset SFace was trained on.
• Open-source liveness models are only rated as safe together with other safeguards. Face Key adds the email code, the PIN and the server part.