Forgot your Google password? Now you can log in with a selfie
Google now allows personal account recovery via video selfies, despite the ongoing threat of real-time deepfake identity theft.
Deep dive
- Google now supports video selfie enrollment for account recovery.
- Users must record a video that tracks head movement to map facial features.
- The stored video is also used for age verification and creating AI avatars.
- An optional toggle allows Google to use the data to improve its facial recognition algorithms.
- The system requires users to move their heads during login to verify 'liveness'.
- Features are excluded from Google Workspace, child accounts, and Advanced Protection Program enrollees.
- Users can delete the stored video data at any time through account settings.
Decoder
- Advanced Protection Program: Google's highest security tier, which enforces mandatory physical security keys and restricts third-party app access to protect high-risk accounts.
- Deepfake: AI-generated synthetic media that replaces a person's likeness in digital content, increasingly capable of bypassing simple liveness detection.
Original article
Getting locked out of an account is no fun. Google has a few ways to help you regain access if you happen to forget your password or lose an authenticator, including recovery contacts and backup codes. Now, Google has a completely new option: your face. You can now give Google a video record of your face and sign into your account with a selfie, which sounds like something people are going to just love.
You will have to set this feature up ahead of time if you want the option of regaining account access with a selfie later on. To get started, verify your account type is supported. You won’t be able to configure selfie sign-ins for Workspace accounts, child accounts, or any account enrolled in Google’s Advanced Protection Program.
Configuring selfie sign-in requires you to record a video, which Google will store on its servers. Google’s selfie sign-in landing page includes the typical disclaimers about privacy and data access, promising that the company will keep the video encrypted and won’t use it for any other purposes unless you opt in.
Selfie videos can be used for login purposes, to verify your age for accessing certain account features, and to create an AI avatar. Currently, Google does have an optional toggle in the setup flow that allows the company to use your selfie video to improve its facial recognition tech. A Google spokesperson confirms this is not required to use the new account recovery feature, and the company will not use the video for anything else if you leave the box unchecked.
Assuming you’re okay with all that, you will use the camera on your phone or computer to record yourself looking around as instructed. This allows Google’s models to accurately map your face so the system can compare that to selfies you take in the future to verify your identity. Google notes it may ask users to update their selfie videos on occasion.
When you use a selfie to access your account, Google will have you move your head around to ensure you’re a living human. It matches this data against the original video, and boom, you’re logged in. However, in the age of AI, it’s not very hard to make deepfake videos of someone. It’s even possible to do that in near real-time, as would be required for Google account recovery.
Google claims it has multiple layers of security measures to detect deepfakes, but this method may not be as secure as other options. After all, Google won’t allow those using Advanced Protection to use selfie sign-ins. Advanced Protection also requires you to use a security key, restricts third-party apps from accessing your account, and conducts more Gmail scans to detect phishing.
If you don’t mind giving Google your face, you can record a selfie video in just a few minutes. Google notes that you can choose to delete the video from its servers at any time from your account settings.
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi