If you get knocked on the head and get all your devices stolen and have amnesia, Google will let you back in with a selfie

security

You'll need to be able to move your head side to side to make sure you're not a deepfake

Tired of worrying about how you might recover all the precious data stored in your Google account if you somehow lose your devices and forget your email address and phone number? Just give Google a video of your face and AI will recognize you to restore access.

Selfie sign-ins are now available for Google accounts, the Chocolate Factory announced on Thursday. This option is restricted to regaining access after email or phone recovery options fail.

Going through the process of adding a verification selfie is rather simple: Just follow the steps outlined on Google’s help page for selfie video management to enroll. You need a device with a camera and the ability to move your head from side to side in order to show off your profile, as well as your full-frontal face card. 

That side-to-side movement is designed to prevent the use of live deepfake videos, as real-time face replacement tends to struggle with profiles. 

According to Google, if you can’t use any other account recovery method, the company’s system can prompt you to take another selfie video for comparison to the one taken earlier, verifying it's you and letting you back into your account. 

Why this, why now?

This feature announcement from Google raised a number of questions among The Register’s news team. Why now, for starters? Deepfake videos are constantly improving, and it’s likely only a matter of time until a side view can be handled with ease. 

A Google rep told The Register that it sees a trend toward passkeys and other forms of device-based authentication, which means a lost device often means a lost account.

“Users can choose whatever method they prefer, we expect most will prefer the ease of use of passkeys for signing in regularly, and use selfie for times like when they lose their phone or the device with their passkey,” Google said in response to our questions. 

So it is not like Apple’s Face ID or face unlock on Android, Google confirmed – “they serve different purposes.” That, and it might not even be sufficient to prove you’re you. 

“Passing a selfie video alone may not always be sufficient to get back into your account,” Google explained in the email. “We evaluate the overall risk based on many factors and may require additional sign-in methods to help make sure it’s actually you signing into your account.”

That's because Apple devices with Face ID, and some higher-end Android devices, are equipped with infrared cameras that capture depth maps to match points on a user’s face to a stored 3D map of their appearance. Those are harder to fool. 

Google’s selfie sign-in system, on the other hand, is essentially relying on plain video, AI, and the hope that deepfakes haven’t become good enough to get around those turn-to-the-side distortions. Unfortunately, facial recognition AI is reliably unreliable. Heck, even Google’s had plenty of run-ins with it over the years, and good facial recognition algorithms are a hot commodity nowadays.

Then there's the fact that you’re giving Google a live recording of your face, and that could be quite valuable to the company in other contexts. 

As Google noted in its announcement, those facial scans are encrypted at rest, are only stored with user consent, and are “used only for helping you sign in, unless you opt to share it for additional purposes.”

“You have the option to allow Google to use your video and related data to help ongoing efforts to develop and improve facial recognition, age estimation, and other verification methods,” the company notes on the selfie help page. 

The option, labeled “Improve Google Services” on the page where users can record a selfie for account recovery purposes, is unselected by default, but we could imagine Google has a vested interest in getting you to click that.  ®