Reverse-lookup Service Exposed Millions of Photos of People’s Faces

When someone uploads a photo to the people-search tool ClarityCheck, the website has a clear message: "Your reverse image search is private and secure." However, new research shows the website left more than 9 million image files, including photographs of people's faces, publicly exposed. And a second misconfiguration publicly exposed people's email addresses and phone numbers.

Overall, according to findings from independent security researcher Jeremiah Fowler, the exposed ClarityCheck database contained roughly 450 GB of images, including what appeared to be profile images, screenshots and other photographs of adults, teenagers and children. All of the images were stored in an unsecured Amazon S3 bucket, with files in folders named "faces" and "profiles," which could be accessed by anyone online through a URL included in the company’s publicly available website code.

ClarityCheck is one of a number of so-called people-finder tools that have appeared online in recent years. These websites broadly claim to be able to search the web, public records and other databases to identify individuals. ClarityCheck’s website says it can run searches on phone numbers, email addresses, vehicle identification numbers (VIN) and names. Its photo-search page says it can help "identify anyone in a photo" and find social media profiles "in seconds."

Please select this link to read the complete article from WIRED.