They did mention that they tested against photos, and worked with hollywood makeup artists to make masks to test the phone as well. The number they mention for the odds that someone elses face will match yours is 1 in 1,000,000. They also said that touch id has a 1 in 50,000 chance, so it is 20x more secure.(I say that a bit tongue in cheek) I would like to know how they crunched these numbers though.