Reverse-lookup service exposed millions of photos of people’s faces

” New research , though, shows that the website left more than 9 million image files, including photographs of people’s faces, publicly exposed . And a second misconfiguration publicly exposed people’s email addresses and phone numbers. Overall, according to findings from independent security researcher Jeremiah Fowler, the exposed ClarityCheck database contained roughly 450 GB of images, including what appeared to be profile images, screenshots, and other photographs of adults, teenagers, and children.

All of the images were stored in an unsecured Amazon S3 bucket, with files in folders named “faces” and “profiles,” which could be accessed by anyone online through a URL included in the company’s publicly available website code. ClarityCheck is one of a number of so-called people-finder tools that have appeared online in recent years. These websites broadly claim to be able to search the web, public records, and other databases to identify individuals.

ClarityCheck’s website says it can run searches on phone numbers, email addresses, vehicle identification numbers, and names.