AWS rekognition medium security documentation change
Summary
Added details about ChallengePreference options (FaceMovementChallenge) and guidance for selecting challenge types based on security considerations. Expanded security recommendations including attack types, false accept/reject rates, and device security controls.
Security assessment
The change introduces security considerations for challenge type selection, explicitly discusses attack mitigation, and recommends additional security controls (geolocation, OTPs). The documentation now warns about accuracy trade-offs and device security requirements.
Diff
diff --git a/rekognition/latest/dg/face-liveness.md b/rekognition/latest/dg/face-liveness.md index c21685393..654628578 100644 --- a//rekognition/latest/dg/face-liveness.md +++ b//rekognition/latest/dg/face-liveness.md @@ -24 +24 @@ When you configure your application to integrate with Face Liveness feature, it - * [CreateFaceLivenessSession](https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CreateFaceLivenessSession.html) \- Starts a Face Liveness session, letting the Face Liveness detection model be used in your application. Returns a SessionId for the created session. + * [CreateFaceLivenessSession](https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CreateFaceLivenessSession.html) \- Starts a Face Liveness session, letting the Face Liveness detection model be used in your application. Returns a SessionId for the created session. Also allows you to set your ChallengePrefrence, so you can use the FaceMovementChallenge option. @@ -35 +35 @@ You will use the AWS Amplify SDK to integrate the Face Liveness feature with you -When the user’s face moves into the oval displayed on their device, the Amplify SDK displays a sequence of colored lights on the screen. It then securely streams the selfie video to the cloud APIs. The cloud APIs carry out real-time analysis with advanced ML models. After the analysis is complete, you receive the following on the backend: +When using FaceMovementAndLightChallenge the user’s face moves into the oval displayed on their device, the Amplify SDK displays a sequence of colored lights on the screen. It then securely streams the selfie video to the cloud APIs. Alternatively, when using FaceMovementChallenge, the user’s face moves into the oval displayed on their device, but there are no sequence of colored lights. While 'FaceMovementAndLightChallenge' remains the best setting to maximize accuracy, 'FaceMovementChallenge' allows customers to prioritize faster speed of liveness checks over accuracy. When selecting between these settings, customers should consider their use case requirements including expected attack types, desired false accept and false reject rates, and additional checks such as geolocation (e.g. based on IP), One Time Pass codes (OTPs), etc. Customers should make this decision after testing Liveness performance with various confidence score thresholds on their specific content. In addition, with both liveness check types the application owners should implement controls to secure the device the video stream is sent from. After the analysis is complete, you receive the following on the backend: