9 million images of people’s faces exposed by reverse lookup service
Brief
Researcher Jeremiah Fowler found a cloud database containing more than 9 million image files accessible without authentication, WIRED reports .
The leaky bucket , containing some 450 GB of images, was traced back to a US-registered company called ClarityCheck.
In their own words, ClarityCheck says:
“Use reverse image search to identify anyone in a photo. Find names, social profiles, and online presence in seconds.”
While ClarityCheck says it does not use facial recognition, it does describe its image function as a way to identify people and find their names and social profiles.
Granted, there’s a difference.
- An image search looks for identical or visually similar images, often using image embeddings, metadata, or indexed pages.
- Facial recognition detects a face, derives face-specific features, and compares them to a structured, face-indexed collection of digital images.
All credited sources
Highest-trust first. Dates are the publisher's original publish time.
9 million images of people’s faces exposed by reverse lookup service
Researcher Jeremiah Fowler found a cloud database containing more than 9 million image files accessible without authentication, WIRED reports .
The leaky bucket , containing some 450 GB of images, was traced back to a US-registered company called ClarityCheck.
In their own words, ClarityCheck says:
“Use reverse image search to identify anyone in a photo. Find names, social profiles, and online presence in seconds.”
While ClarityCheck says it does not use facial recognition, it does describe its image function as a way to identify people and find their names and social profiles.
Granted, there’s a difference.
- An image search looks for identical or visually similar images, often using image embeddings, metadata, or indexed pages.
- Facial recognition detects a face, derives face-specific features, and compares them to a structured, face-indexed collection of digital images.
But does that difference matter when your face gets uploaded and stored in an unsecured cloud environment?
It is important to remember here that faces are persistent identifiers. A leaked password can be reset, whereas a person cannot easily replace their face. When an image of someone is linked with names, social profiles, addresses, emails, or phone numbers, that information could potentially be misused for impersonation, targeted phishing, doxxing, or catfishing.
ClarityCheck disputed that the data was publicly exposed because accessing it required an unindexed URL. However, the images didn’t require authentication, and Fowler was able to discover the URLs through the site’s code.
It is unknown how long the bucket was exposed before Fowler found it. Despite earlier alerts from Fowler, ClarityCheck did not restrict access to the database until WIRED contacted the service in July.
9 million images of people’s faces exposed by reverse lookup service
Researcher Jeremiah Fowler found a cloud database containing more than 9 million image files accessible without authentication, WIRED reports .
The leaky bucket , containing some 450 GB of images, was traced back to a US-registered company called ClarityCheck.
In their own words, ClarityCheck says:
“Use reverse image search to identify anyone in a photo. Find names, social profiles, and online presence in seconds.”
While ClarityCheck says it does not use facial recognition, it does describe its image function as a way to identify people and find their names and social profiles.
Granted, there’s a difference.
- An image search looks for identical or visually similar images, often using image embeddings, metadata, or indexed pages.
- Facial recognition detects a face, derives face-specific features, and compares them to a structured, face-indexed collection of digital images.
But does that difference matter when your face gets uploaded and stored in an unsecured cloud environment?
It is important to remember here that faces are persistent identifiers. A leaked password can be reset, whereas a person cannot easily replace their face. When an image of someone is linked with names, social profiles, addresses, emails, or phone numbers, that information could potentially be misused for impersonation, targeted phishing, doxxing, or catfishing.
ClarityCheck disputed that the data was publicly exposed because accessing it required an unindexed URL. However, the images didn’t require authentication, and Fowler was able to discover the URLs through the site’s code.
It is unknown how long the bucket was exposed before Fowler found it.