A service built to identify strangers from a photo left 9 million faces wide open

The people in this database did not sign up for anything. That is the whole point of the service. ClarityCheck, a US-registered people-finder, invites you to upload a photo of someone and get back a name, social profiles and whatever else is findable. Its pitch is identifying strangers.

Security researcher Jeremiah Fowler found the collection sitting in an unsecured Amazon S3 bucket with no password on it: 450 GB and more than 9 million image files. Profile pictures, screenshots, ordinary photographs. Adults, teenagers and children. Fowler says he alerted the company and nothing happened; access was only restricted in July, after WIRED contacted the service. Malwarebytes and several other outlets wrote it up this week.

ClarityCheck's terms say uploaders must have permission from the people in the pictures, which is a clause that collapses the moment you think about it. Nobody pays to identify themselves, or someone they already know. Fowler's reading is the obvious one: most of the faces in there were uploaded by someone else, about someone else, without a word to the person in the frame.

There is no clean fix, because a face is not a password. You cannot rotate it after a leak, and it stays useful to a scammer for decades - impersonation, romance fraud, a convincing fake profile. What you can control is your own end: think twice before feeding someone else's photograph into a lookup tool, and if you find yourself surfacing in one of these results, screenshot the page and file a removal request with the host. Tendvane's Privacy and accounts check works on the machine in front of you, showing what's exposed there; a stranger's open storage bucket is beyond anything running on your PC.