Google confirmed this to BBC News on Friday after one of the outlet’s reporters, Chris Fox, shared a video of himself unlocking a Pixel 4 while pretending to be asleep and/or dead. While Google hasn’t drawn attention to this aspect of its new face unlock feature in any of the Pixel 4's ads or demonstrations so far, it did warrant enough concern to earn a disclaimer on the phone’s support page: “Your phone can also be unlocked by someone else if it’s held up to your face, even if your eyes are closed.”
— Chris Fox (@thisisFoxx) October 15, 2019
What’s their awesome, galaxy-brain advice? “Keep your phone in a safe place,” the support page continues. Thanks, Google. Android also has an optional lockdown option that shuts off a device’s biometric access so the only way to get in is with a PIN.
Still, it’s more than a little alarming to think a roommate or partner—hell, even a kid by accident (or not; Fortnite skins don’t exactly grow on trees, after all)—could crack your phone while you snooze, especially since Google’s confident enough in the security of its face unlock feature that you can authorise payments and log in to apps with it.
To be clear, Apple’s Face ID can do all this too, but its default requires you to prove you’re “alert”, i.e. looking at the device, before giving you the all-clear to access it. Of course, you can always disable this extra security measure via the settings menu.
It doesn’t appear to be an oversight, either, since one of the many, many, many Pixel 4 leaks showed a setting in the face unlock menu labelled, “Require eyes to be open.” So either Google threw this out as an unnecessary precaution or still hasn’t perfected it quite yet since this option won’t be available on the Pixel 4 or Pixel 4 XL when they go on sale next week, the company told BBC News.
Still, even with this worrying function, Google seems steadfastly confident in the security of its face unlock feature. “They are actually only two face authorization solutions that meet the bar for being super-secure. So, you know, for payments, that level—it’s ours and Apple’s,” Pixel product manager Sherry Lin said per the BBC.
Google did not immediately respond to Gizmodo’s request for comment, but I suspect whatever statement they ultimately provide will look something like this non-comment a spokesperson told the Verge:
“We don’t have anything specific to announce regarding future features or timing, but like most of our products, this feature is designed to get better over time with future software updates.”
Until then, I guess Pixel 4 users will just have to take precautions to ward off face-data snatchers coming for them while they sleep. Someone get me R.L. Stine: I’ve got his next 21st-century Goosebumps story.