Glance, the open-source app that unlocks a Mac when it sees your face, is good software with an honest README. The README’s first heading after the title is a warning that it is not as secure as Face ID or Touch ID, and the author calls it “a convenience feature, not a security upgrade”. Most of the reels showing it off skip that part. This post is that part, written for someone deciding whether to put it on the Mac they run a business from.
The setup guide is separate. This is about what the camera can actually know.
Face ID measures a shape. A webcam records a picture.
The iPhone’s Face ID does not recognise your face from a photograph of it. The TrueDepth camera projects more than thirty thousand invisible infrared dots onto your face and reads how they land, which produces a depth map: a measurement of the shape of your head. A printed photo is flat, so the dots land flat, and the match fails before any comparison of features begins. Apple’s published figure is that a random person has less than a one in a million chance of unlocking your phone with their face, against one in fifty thousand for Touch ID.
A MacBook has no such projector. Its webcam produces a two-dimensional image, the same kind of image a photograph is. Any software working from that image is comparing pictures to pictures, and the entire question of security becomes: how well can it tell a picture of a live face from a picture of a picture?
How Glance answers that question
Recognition and liveness are two separate systems in Glance, and both have to pass.
Recognition uses an ArcFace model, a well-regarded open-source face recogniser, to turn each frame into a 512-number embedding and compare it with the embeddings captured when you enrolled. Above a similarity threshold, it is you. This part is mature technology and it works; a photograph of you also scores as you, because to the model a photograph of your face is your face.
Liveness is the part doing the security work, and it is worth understanding exactly what it looks for, because the author documents it. Over a rolling two-second window it watches for five cues in two roles:
- Deny cues, which are evidence of a spoof. Screen glare, meaning the reflections a phone or tablet screen throws back at the camera. A device-shaped rectangle framing the face. Either one fails the attempt outright.
- Confirm cues, which are evidence of a live face. Landmark geometry that behaves like a three-dimensional object rather than a flat one. Parallax at the nose as the head turns. Blinks. Any one is enough, and their absence is not a failure, because a real person can sit still and not blink.
Light liveness uses the deny cues only. Heavy uses both. The author’s own claim is precise: with Heavy on, Glance defeats a printed photo and a photo on a phone screen with reasonable confidence, and it does not reliably defeat a video of you.
What that means in practice
A video of your face is not hard to obtain. If you have ever been on a video call that was recorded, appeared in a company reel, or posted a clip of yourself anywhere, one exists. Played back on a tablet held up to the webcam, it moves, it blinks, its nose shows parallax, and the only defence left is the glare and rectangle detection, which depends on lighting and how carefully the tablet is held.
Nobody is going to do this to steal a personal laptop’s photo library. Someone might do it for a Mac that is signed in to the admin of six Shopify stores, a payment processor and a bank. Security is always about who would bother, and the answer changes with what is behind the lock.
The part that is not about faces at all
Because macOS offers no way for a third-party app to authorise a login, Glance unlocks the Mac by typing your password. To do that it has to hold your password and it has to hold the Accessibility permission, which lets an app type into anything.
The author handles both carefully. The password is encrypted with a key kept in the Keychain behind Touch ID, released only while a session is authorised, and the app refuses to type unless it is really at the lock screen. These are the right decisions. They are also decisions made by one developer in an app that is a few weeks old and not accepting outside review through pull requests. You are trusting that the code does what the README says, that it keeps doing so through updates, and that no other process on the machine finds a use for an app that is allowed to type.
Touch ID and the password field involve none of that. The password never sits decrypted in any app’s memory, and no app has permission to type it.
Glance, Touch ID, or the Watch
Touch ID is the baseline: a fingerprint read by a sensor Apple built and audits, with the one-in-fifty-thousand figure behind it. It requires reaching for the key, which is the whole complaint Glance exists to answer.
Auto Unlock with Apple Watch is built into macOS. When your unlocked Watch is on your wrist and near the Mac, the Mac unlocks as you open it. No typing, no camera, and the token is Apple’s, not a stored password. If you own a Watch, this is the answer to the reaching problem with none of the trade-offs above. It does need the Watch to be on and unlocked, and it takes a second or two.
Glance is the most pleasant of the three to use and the only one where the security depends on lighting. It belongs on a personal machine whose worst case is embarrassment.
Our rule
ScaleWise runs other people’s stores. A team Mac is a key to a client’s admin, their customer data and sometimes their payouts, and the value of what is behind the lock is not ours to spend on convenience. So the rule is simple: Touch ID and a strong password on every work machine, Apple Watch unlock if you have one, and Glance on whatever you like at home. We would rather the team reach for the key.
None of that is a criticism of the app. It is a well-built tool with an unusually straight README, and the right response to an honest warning is to read it and act on it. That is all this post is.
