I have the iPhone X and I believe a photograph is insufficient. The way Apple implemented FaceID — and I’m probably simplifying the actual process — is that it uses stereo cameras (one visible, one IR) with a projected IR dot grid to build a 3D mesh of your face from multiple angles.
The calculated values are hashed and stored in a protected area of the phone, accessible only through Apple’s interface.
A photograph would not return the correct depth map and would be rejected. It’s actually quite amazing what they pulled of. It’s accurate, fairly quick, and works in a wide variety of lighting conditions.
It can even work if you are wearing glasses (including sunglasses) or haven’t shaved in a while. Although I’ve found after about 10 days of going without a shave it can get a little confused sometimes.
As always, you can disable it and go to a complex passcode if you prefer.
a photograph will not work.. it utilized 3 D to recognize your face... a picture will not do it... see the actual tech here
https://www.youtube.com/watch?v=g4m6StzUcOw