Face ID has upsides and downsides on both security and usability and isn't less secure than a PIN or Touch ID in practice
Context & Ripple Effects
Days after Apple unveiled the hardware behind Face ID — the infrared camera, flood illuminator and dot projector array that models a face and requires user attention to unlock or pay — Have I Been Pwned founder Troy Hunt weighed in on whether it actually beats the alternatives. As the analyst behind a breach-notification service built on leaked credentials, his verdict carries weight: Face ID is not less secure than a PIN or Touch ID in practice, with trade-offs on both the security and usability sides.
The assessment landed before the broader industry consensus formed. Subsequent day-to-day speed testing found Face ID slower per unlock than Touch ID but faster in real usage, and by 2021 Apple was building directly on biometric unlock when it demonstrated passkeys alongside Microsoft and Google — making Hunt's early framing of biometrics as legitimate authentication a data point in how that shift got normalized.
First-order effects
- iPhone buyers deciding whether to trust Face ID get a clear answer from one of the most credible voices in breach analysis: adopting it does not weaken their security posture versus a PIN or Touch ID.
- App developers and payment flows gain cover to rely on Face ID as an authentication factor, since the gaze requirement and sensor design address the attention and spoofing objections raised at launch.
Second-order effects
- Weak and reused PINs and passwords remain the practical attack surface — the same failure mode behind the Ring devices shown vulnerable to credential stuffing and brute force — which strengthens the case for device-local biometrics over memorized secrets.
- Apple's confidence in Face ID as a primary unlock becomes the foundation for cross-industry moves like passkeys, where Microsoft and Google follow Apple's lead in advocating passwordless sign-in gated by Face ID or Touch ID.
Third-order effects
- If the pattern holds, authentication structurally migrates from shared secrets stored on servers — the targets of every breach Have I Been Pwned tracks — to biometric-gated, device-bound credentials, shrinking the payoff of large-scale credential theft.
- Biometric acceptance also raises new questions the corpus only hints at: a face becomes the single key across accounts, so the security debate shifts from 'is biometrics strong enough' to what happens when that key cannot be rotated like a password.
The trend: Consumer authentication is shifting from memorized PINs and passwords toward biometric-anchored, device-bound credentials, with Apple's Face ID as the mainstream catalyst and the passkeys alliance as its institutional endpoint.