iPhone X owners have found that Face ID isn’t available as an authentication method for the “Ask to Buy” feature, which allows parents to approve their kids’ iOS purchases and downloads. Instead, the parent (or any other “family organizer,” as Apple terms it) must enter their entire Apple account password to approve each individual purchase attempt.
Users are frustrated because equivalent functionality was available on Touch ID devices, and that functionality has been lost in the transition to the iPhone X. Face ID can be used as an authentication method for other purchases, just like Touch ID before it—but Touch ID also worked for “Ask to Buy,” and Face ID doesn’t.
Apple has touted Face ID’s ability to replace Touch ID in interactions for which Touch ID was previously used. In fact, we found when reviewing the iPhone X that third-party apps using Touch ID automatically used Face ID instead on that device, with no action needed from Apple. It was a slick, seamless transition, so it’s all the more surprising that it doesn’t work for an iOS feature offered by Apple itself. Apple’s documentation of the feature makes no mention of either Touch ID or Face ID.
Parents of large families with several children, each of whom might have an iOS device available to them, will find that the requests mount up quite quickly—especially right after the holidays. Kids cashing in App Store gift cards add to the requests already coming in from normal use and in-app purchases in games.
When we reviewed the iPhone X, we were also surprised that the device could only store one face, making sharing one device within a family more difficult than with Touch ID. However, a passcode could still be used. In the case of Ask to Buy, though, the parent doesn’t just have to enter their passcode—they have to enter their Apple password. And a secure password can obviously be quite long or quite complex—or both.
Users are sharing complaints about this on support forums, but Apple has not made it clear why this limitation is in place. Apple has said that Face ID is most likely to be fooled by a close family member who bears a strong physical resemblance to the face data stored on the device, and we’ve already seen some alleged examples of Face ID on a parent’s phone getting fooled by that parent’s child. As a result, the users who have taken to support forums to complain have asked if Apple disabled this feature for Face ID because of the possibility of the child getting past it.
However, even if the child could get past the parent’s Face ID authentication (and we have no data on how frequently that might happen), they could still simply make the purchase on the parent’s phone and access the app or purchase through family sharing on their own device.
We’ve reached out to Apple for clarification on this functionality.
https://arstechnica.com/?p=1236817