Thanks Andrew.

1a. Facial spoofing attacks can easily launched via printed photos, video replays and 3D masks of a face. There is a detailed paper written on this. That is why it is critical to implement strong liveness detection measures for facial authentication that recognize when a facial image is not a live. To share a bit more, spoof detection can be classified as either “active”, requiring interaction with the subject, or “passive” analysis requiring no interaction.  

1b. Fingerprint spoofing attack can easily be fooled by fake fingerprints digitally composed of many common features found in human prints. Likewise another paper shares the details. What I think is concerning is the capture in the past has also been attempted on gummy fingers that is fake Fingers. Liveness test is still the added assurance check needed to have a robust check in the mobile device.

The challenge for a/m is not on the detection technology but how to more towards a more accurate match rate an d at the same time not in the expense of making the device bulky or more draining to the limited battery level.

2. Actually remote wipe is more of a mitigation as ultimately, if the data remain encrypted and the device has lock enabled, access is restricted and even data siphoned off the shutdown or locked device will not necessary have the plain data revealed. So with encryption and locked setting, the mitigation suffice as baseline.

Hope the above clarifies.

Thanks for clarifying btan. Highly useful information!