Couple of issues here, speaking as a facial recognition developer, of arguably one of the leaders in the industry.<p>1) The use of 3D data is a step in the right direction, but to use it reliably it has to constantly re-calibrate to the individual(s) it is supposed to pass. This is very important and a constant issue if using a person's 3D depth data as their face for authentication. My employer pioneered the use of 3D data for facial recognition, via 3D reconstruction, before scanning and depth cameras were feasible. In doing so, we became aware of the significant variation an individual's 3D facial form undergoes during <i>any</i> time period: different times of the day, yes, significant 3D facial form transformation; different days, definitely. Females significantly more, as they experience 3D form transformations simply from their menstrual cycle. Men who drink, less so than women, also gain significant facial form transformations on a weekly basis. Over the course of a season, everyone undergoes significant 3D form transitions, to the degree authentication is not reliable unless constant re-calibration occurs. Which introduces issues of system failure after indeterminate lapses of use, or sudden physical transformation - such as an accident, where your face is swollen. A person could be attacked, and their face altered to the degree their phone no longer authenticates. A person could fast for 2 days, not use their phone, and it will no longer pass.<p>2) They should be using multiple biometrics for authentication. The facial image in combination with the depth information, if treated separately with completely separate verification trained algorithms, only counts as two biometrics. Reliable authentication of a device attached to one's credit cards and finances requires a MINIMUM of 3 biometrics. They could solve that with the addition of Touch-ID or the addition of a pass code in addition to the face image and the face 3D depth data. But that borders on 'inconvenience', and I feel consumer pleasing stupidity. Sometimes being safe should require an extra step, simply so the consumer has the assurance their data is safe. It's like hearing the click as the lock on your door seals. Too automatic, and it's insecure because one never knows if it is active.<p>However, ignoring the face as authentication, the iPhone just became a very slick 3D avatar creator.