fix(compliance): honest liveness claims, turnRight fix, dead-code + supply-chain trim - #33
Open
GhagSagar23 wants to merge 3 commits into
Open
fix(compliance): honest liveness claims, turnRight fix, dead-code + supply-chain trim#33GhagSagar23 wants to merge 3 commits into
GhagSagar23 wants to merge 3 commits into
Conversation
…liance section - README no longer claims PAD against photos/recordings/deepfakes/3D masks (it has none); states plainly it is active challenge-response only, not ISO/IEC 30107 PAD (removes FTC Act 5 / EU UCPD deceptive-claim exposure) - remove NSMicrophoneUsageDescription instruction (mic is unused; App Store 5.1.1 risk) - add Privacy & compliance section: on-device-only, ML Kit disclosure, no encryption/ retention by the library, consent is the consuming app's duty (GDPR/BIPA/PIPL/DPDP) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- V1 turnRight used `>` so a forward-facing head (yaw ~0) auto-passed instantly; now requires yaw more negative than the threshold magnitude (mirrors V2). Root-cause fix, robust whether or not a HeadTurnDetectionThreshold is configured. - delete golden-ratio (V1) and facial-symmetry (V2) computations + calculateSymmetry: they were only print()ed, never gated pass/fail — keeping them implied anti-spoofing the package does not have. - guard the V2 image-error debugPrint behind kDebugMode (the one log that reached release). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ad plugin scaffold
- `image` (^4.0.15) declared but never imported (pulled archive/xml/petitparser/crypto)
- `plugin_platform_interface` + livelyness_detection_{method_channel,platform_interface}.dart
are untouched flutter-create boilerplate (getPlatformVersion), never registered natively
- shrinks the supply-chain / attack surface of a biometric package
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Compliance quick wins from the worldwide biometric-compliance audit — the ponytail-minimal, safe subset. Design-level items (real PAD, consent surface, at-rest encryption, camera consolidation) are intentionally out of scope and left for a follow-up decision.
Commits
cfae9afNSMicrophoneUsageDescriptioninstruction (mic unused); add a Privacy & compliance section5adbec3turnRightfix (>→ require yaw more negative than the threshold magnitude; a forward face no longer auto-passes); delete dead golden-ratio + facial-symmetry stubs (onlyprinted, never gated); guard the V2 errordebugPrintbehindkDebugModee2e34faimage+plugin_platform_interfacedeps; delete the deadmethod_channel/platform_interfacescaffoldVerified
flutter analyze— no new issues. (The 2 pre-existingdevelopwarnings —@override/Color.value— are already fixed in the dependency-upgrade PR chore: Flutter 3.44 compat + dependency upgrades (v0.0.1+6) #32; not touched here to avoid a duplicate/conflict.)flutter pub getclean after dropping the two deps.The headline this addresses
The package was marketed as anti-spoofing while implementing none — the biggest legal + security exposure for worldwide use. This PR makes the docs honest and fixes the one gesture bug that let a still face pass, but it does not add real presentation-attack detection. Until real PAD is added, do not rely on this package alone for KYC/identity.
Out of scope (needs a design decision)
startWithInfoScreendefault).CapturedImage.delete()+ encryption hook.thresholdConfig(config parity with V1).Audit status
Full audit was 8/9 dimensions (verify pass completed only for logging; inclusivity + synthesis/critic hit an account session limit). The remaining verify/inclusivity/critic passes + extra jurisdictions will be completed after the limit resets.