Couple of issues here, speaking as a facial recognition developer, of arguably one of the leaders in the industry.
1) The use of 3D data is a step in the right direction, but to use it reliably it has to constantly re-calibrate to the individual(s) it is supposed to pass. This is very important and a constant issue if using a person's 3D depth data as their face for authentication. My employer pioneered the use of 3D data for facial recognition, via 3D reconstruction, before scanning and depth cameras were feasible. In doing so, we became aware of the significant variation an individual's 3D facial form undergoes during any time period: different times of the day, yes, significant 3D facial form transformation; different days, definitely. Females significantly more, as they experience 3D form transformations simply from their menstrual cycle. Men who drink, less so than women, also gain significant facial form transformations on a weekly basis. Over the course of a season, everyone undergoes significant 3D form transitions, to the degree authentication is not reliable unless constant re-calibration occurs. Which introduces issues of system failure after indeterminate lapses of use, or sudden physical transformation - such as an accident, where your face is swollen. A person could be attacked, and their face altered to the degree their phone no longer authenticates. A person could fast for 2 days, not use their phone, and it will no longer pass.
2) They should be using multiple biometrics for authentication. The facial image in combination with the depth information, if treated separately with completely separate verification trained algorithms, only counts as two biometrics. Reliable authentication of a device attached to one's credit cards and finances requires a MINIMUM of 3 biometrics. They could solve that with the addition of Touch-ID or the addition of a pass code in addition to the face image and the face 3D depth data. But that borders on 'inconvenience', and I feel consumer pleasing stupidity. Sometimes being safe should require an extra step, simply so the consumer has the assurance their data is safe. It's like hearing the click as the lock on your door seals. Too automatic, and it's insecure because one never knows if it is active.
However, ignoring the face as authentication, the iPhone just became a very slick 3D avatar creator.
Not hating on your points, because they're valid, but the sudden transformation part of #1 strikes me as similar to when your hands are wet and you're trying to use TouchID. The phone will shake the passcode prompt a few times and eventually give up and ask you for your passcode.
I don't really see a problem with this. Apple has done a good job of making it known their biometrics aren't perfect, and will err on the side of caution when tested with strange inputs. You're not allowed to setup the phone without a passcode, and it serves as the final barrier to access if biometrics fail.
Ad 1): They briefly mentioned in the keynote that Face ID does indeed adapts to gradual changes like growing a beard. So, that form of recalibration seems to be part of the concept.
Do you have reason to doubt that Apple did not do all of this or even more? In the end we’ll see but one indicator is that the banks at least let them use Apple Pay with FaceId. I am guessing here but I suppose they will still get the “card present” tarifs and if I recall correctly that was tied to the fact that banks deemed TouchId a sufficient form of authentication.
1) The use of 3D data is a step in the right direction, but to use it reliably it has to constantly re-calibrate to the individual(s) it is supposed to pass. This is very important and a constant issue if using a person's 3D depth data as their face for authentication. My employer pioneered the use of 3D data for facial recognition, via 3D reconstruction, before scanning and depth cameras were feasible. In doing so, we became aware of the significant variation an individual's 3D facial form undergoes during any time period: different times of the day, yes, significant 3D facial form transformation; different days, definitely. Females significantly more, as they experience 3D form transformations simply from their menstrual cycle. Men who drink, less so than women, also gain significant facial form transformations on a weekly basis. Over the course of a season, everyone undergoes significant 3D form transitions, to the degree authentication is not reliable unless constant re-calibration occurs. Which introduces issues of system failure after indeterminate lapses of use, or sudden physical transformation - such as an accident, where your face is swollen. A person could be attacked, and their face altered to the degree their phone no longer authenticates. A person could fast for 2 days, not use their phone, and it will no longer pass.
2) They should be using multiple biometrics for authentication. The facial image in combination with the depth information, if treated separately with completely separate verification trained algorithms, only counts as two biometrics. Reliable authentication of a device attached to one's credit cards and finances requires a MINIMUM of 3 biometrics. They could solve that with the addition of Touch-ID or the addition of a pass code in addition to the face image and the face 3D depth data. But that borders on 'inconvenience', and I feel consumer pleasing stupidity. Sometimes being safe should require an extra step, simply so the consumer has the assurance their data is safe. It's like hearing the click as the lock on your door seals. Too automatic, and it's insecure because one never knows if it is active.
However, ignoring the face as authentication, the iPhone just became a very slick 3D avatar creator.