Concepts
Liveness is advisory
The browser liveness check is a signal, not a guarantee. What it does and what it cannot do.
Be clear about this when you decide where to use FaceCard.
Liveness is computed in the browser, and it is advisory. The SDK looks for signs of a live face, such as a blink or head motion, and sends a liveness object (a score and the checks it ran) with enroll and match. Because the check runs on the user's own device, a determined attacker who controls that device can fake the result. The server does not treat it as proof.
What it does
- Makes casual attacks harder, such as holding up a photo.
- Gives you a signal you can log and review.
What it does not do
- It is not presentation attack detection. It does not stop video replay, a modified client, or someone injecting descriptors directly into the API.
- It does not replace a second factor for high-risk actions.
What protects you in practice
- Challenges stop a recorded request from being replayed (see Challenges).
- Rate limits slow down guessing (30 requests a minute per IP on the face routes).
- The matching threshold and margin reject faces that are not a clear match (see Matching).
- Your own policy. For money movement, account recovery or admin access, require another factor in addition to a FaceCard sign-in.
FaceCard is a convenient, passwordless way to identify a returning user. Treat it as a strong convenience factor, and add a stronger check where the cost of a wrong accept is high.