"Google" tests "Selfie" video for account recovery

SadaNews - Google has added a new method for logging into accounts that relies on taking a short video of the face, providing a backup option for users who lose access to their phones or usual devices.

The feature primarily targets situations where users cannot log in using available methods; the video can be used to verify the identity of the account owner and restore access.

The new feature does not replace passwords or passkeys or other means of protection, but rather complements the set of recovery options offered by the company. Google recommends that users set up multiple ways to log in, given the potential content of their accounts, including images, emails, documents, and personal data that can be hard to access when the phone is lost or the main device is malfunctioning.

Setting Up the Video

Setting up the feature begins by looking at the device's camera and performing a short set of head movements shown to the user on the screen. These movements aim to capture the face from multiple angles rather than relying on a single static image, before storing the video for later use in the verification process.

When a user encounters a login issue, the system prompts them to record a new video of their face, then compares this clip with the stored video from the initial setup to ensure identity matching before allowing account recovery. This makes the video a backup method that can be used even when the usual phone or computer is unavailable.

However, the availability of the feature does not necessarily mean immediate access for all accounts, as Google has urged users to check their account eligibility and set up the video through the dedicated account management page for the service, indicating that availability may depend on the account, market, or rollout stages.

Countering Impersonation

The verification mechanism relies on more than just comparing the shape of the face. Google states that it uses multiple layers of protection to limit attempts at impersonation using fake images or edited videos, including content known as "deepfakes."

The system asks the user to perform simple movements in front of the camera to prove that the clip is being recorded live, and not a still image or a previously displayed video. The features of the new video are then compared with the stored clip, alongside applying Google's usual security measures to detect suspicious login attempts.

While the company does not provide extensive technical details about the verification models or acceptance criteria for matching, it clarifies that the system combines video matching, live presence tests, and security checks associated with the login attempt. This integration aims to reduce the likelihood of using a fake image or video to access the account.

Data Protection

Google confirms that the face video is recorded with the user's consent, and that the clip is stored encrypted when not in use, and users can delete the video at any time from their account settings, meaning that enabling this method is not obligatory or always required.

According to the company, the use of the video is limited to assisting with login, unless the user chooses to share it for additional purposes. This places control over recording and deletion in the hands of the account owner, while the video remains part of the sensitive authentication data that should be protected, like passwords and passkeys.

The importance of this aspect goes beyond protecting the video from unauthorized access; it extends to preventing it from becoming an identification method used outside its intended purpose. Therefore, the company emphasizes prior consent, storage encryption, and the ability to delete.

Multiple Options

The "Video Selfie" feature is part of a broader trend to reduce user reliance on a single method for accessing their account. Google has previously introduced passkeys that depend on device lock or biometric data instead of traditional passwords, alongside the recovery contacts feature which allows calling on a trusted person when access is lost.

The face video represents an additional pathway for cases where usual devices or authentication codes are not available. However, its effectiveness relies on users having set it up in advance since the system needs a stored reference video before a login issue occurs.

Thus, Google does not provide video as a comprehensive alternative for authentication means but as another layer within the account recovery ecosystem. Setting up multiple login methods remains a critical factor in reducing the likelihood of losing access, especially as a single account is linked to a wide range of services, files, and personal data.