Apple’s HomeView arrives Friday with face recognition, but not Face ID

Apple’s HomeView is scheduled to debut Friday, November 13, with a different approach to recognizing the people around it. Instead of Face ID, the shared home device uses ambient face and voice recognition. Apple’s November 12 security explanation details how it protects those sensor streams; WIRED’s pre-release examination raises questions about resistance to impersonation.

One device, several private accounts

HomeView can personalize its experience for up to six people and connect to their individual iCloud accounts. It is designed to switch between users without exposing one person’s private information to another. Someone could ask about their own schedule or a movie recommendation in Messages, but not a roommate’s travel plans or texts.

Recognition is not the only access check. Before retrieving personal iCloud data, HomeView also checks that the user’s iPhone or iPad is on the same Wi-Fi network and has been recently unlocked, according to WIRED. That adds a condition beyond simply matching the face and voice of whoever is nearby.

WIRED describes the departure from Face ID as a consequence of the job HomeView must do. Face ID is built for someone looking directly at a device at close range. HomeView needs to move quickly between people, using AI processing that cannot all fit within the Secure Enclave, Apple’s physically isolated security chip.

Sensing without opening the camera feed

Apple’s answer is Secure Exclaves: protected computing compartments that process camera and microphone input separately from the main operating system. Unlike the separate Secure Enclave chip, these use a memory-protected environment within the main processor. Apple says the operating system, apps and Apple itself cannot access data being processed inside them.

In Apple’s described recognition flow, a camera compartment detects faces and queues frames for processing. A separate person-recognition compartment loads enrolled face and voice models and identity information from protected storage. The main system can receive a signal that someone may be present, but not the underlying images or audio.

The machine-learning work also gets a protected route through Apple’s Neural Engine. Apple says dedicated work queues keep recognition data isolated, and the engine’s state is cleared after each model completes. Ambient input is supposed to become a simpler signal—such as a recognized face—with raw sensor data discarded after processing, rather than retained as recordings.

This also changes what the camera light communicates. Apple argues that a light illuminated throughout ambient sensing would glow continuously and lose its usefulness. Instead, a protected indicator controller allows full sensor data to leave isolation only after ensuring the light has been visible long enough. On HomeView, it also checks that the LED is bright enough.

Our goal is to keep ambient sensor data secure even against highly sophisticated attacks, while giving users a clear, reliable, and tamper-resistant signal whenever their sensors are fully active.

Apple’s Security Engineering and Architecture and Core Operating Systems teams

Protected data is not the same as a correct match

The architecture addresses who can reach sensor data. WIRED raises a different concern: whether HomeView can be fooled about who is asking for personal information. It describes person recognition as less comprehensive than Face ID and potentially more susceptible to attacks using reconstructed 3D depth maps or voiceprints. That is a possible weakness, not an established successful attack.

Households can also choose less personal versions of the experience. WIRED identifies two alternatives to granting access to private calendar and Messages content:

• Guest mode, for using HomeView without the full personal experience.
• A lighter personalized mode that includes things such as playlists other users can access, but leaves calendar and Messages data out.