I just read an article that opens with the claim a woman can’t “reset or revoke the appearance of her cheekbones.”

…what if the woman’s facial information is stolen or misused? If a cybercriminal steals her password, she can change it. If they acquire her credit card number, she can cancel the card. But she can’t reset or revoke the appearance of her cheekbones.

Huh?

Anatomy is not authentication. Cheekbones aren’t the credential.

I feel like we’ve been over this before with fingerprints. They degrade, they change. They can be faked. I guess someone didn’t get the memo and thinks our appearances are binary and static, like a genetic marker. Dare I say there’s still a eugenics theme lingering in American perspectives?

Simon Cole’s Suspect Identities documents evidentiary failures of the biometric industry. The 2009 NAS report Strengthening Forensic Science gutted the claim of fingerprint individuality. Brandon Mayfield infamously got jailed on a fingerprint match that wasn’t his, and doesn’t even get a mention in this new report. Ridge patterns don’t matter if the working surface of the finger is gone, worn, or chemically altered, which is exactly what happens with hands doing any physical work.

The credential is the actual vendor-specific mathematical template, gets priced as such, and the templates are revocable. Vendors rotate their algorithm and the old templates are toast. Templates from Vendor Alice don’t match against Vendor Bob. The research framework for cancelable biometrics has existed since 2001, when Ratha, Connell, and Bolle published the foundational work in Enhancing security and privacy in biometrics-based authentication systems, IBM Systems Journal. Industry adoption remains uneven, which is the actual problem worth writing about.

Every day of every RSA Conference in SF, for at least ten years, I changed my appearance. Good luck finding me twice. It wasn’t by coincidence. I gave talk after talk about it.

A cybersecurity professor writing about facial recognition should know all this prior research exists. The fact his remediation section recommends a technique that defeats the opening premise is a real head scratcher.

What reads right to me is the linking-key argument. Faces aggregate identity across databases. That’s the well-known Clearview AI problem, the data broker problem, the data-extraction capitalism problem.

Adam Harvey named the practice CV Dazzle in 2010, but the underlying tradition runs deeper. Disguise in resistance movements, veiling, drag and queer subcultural face work, the politics of Black hair under surveillance regimes, Jewish assimilation pressures across 19th and 20th century Europe. Identity disruption through appearance modification is the prior art the professor’s framework erases. Shifts in facial hair, adversarial fashion, makeup patterns, and IR-blocking glasses sit inside that lineage, not outside it.

The threat model in the article acts like a static face meets a perfect camera meets an immortal template. None of those three assumptions hold, and the reason they appear plausible at all is cultural. White Christian American identity practice treats the childhood face as the true face, with adult modification read as deception or instability. Protestant investment in the unchanging soul, the passport photo as legal anchor, the LinkedIn headshot as professional contract, the absence of veiling traditions, the cultural prohibition on radical appearance change in adulthood.

The professor’s opening claim that a woman cannot revoke her cheekbones only reads as obvious inside the frame of the white Christian man. Cultures with stronger traditions of appearance modification, which is basically the rest of the world, reason better about credential threat models because they never practiced confusing the face with a credential in the first place.

The same frame shows up in justice system reasoning. “She’s an attractive blonde-haired blue-eyed woman, she can’t be the criminal, only the victim.” I’m seeing it all over the comments in a recent Wall Street lawsuit.

Racialized innocence and the cheekbone fallacy run on the same cultural operating system. To be fair it’s all relative, so we could talk about the variances around the world, but in this article we see the western Christian male bias output clearly.