Who Let The Dogs Out 🐾 on Nostr: Reverse-lookup service ClarityCheck exposed millions of photos of people’s faces ...
Reverse-lookup service ClarityCheck exposed millions of photos of people’s faces
Research by independent security researcher Jeremiah Fowler found the company’s database contained roughly 450 GB and more than 9 million image files, including many face photographs and other images (e.g., profile images and screenshots).
The files were stored in an unsecured Amazon S3 bucket and could be accessed online via a URL exposed through publicly available website code.
A second issue allegedly allowed construction of URLs or API calls that returned personal contact details—email addresses and phone numbers—based on someone’s name.
The company disputed that the data was “publicly exposed,” saying access required knowledge of a specific unindexed URL, but the article notes that exposure risk applies when sensitive data is reachable without proper authentication.
https://www.expressvpn.com/blog/clarity-check-data-exposed/#infosec #disclosure #ClarityCheck #JeremiahFowler
Published at
2026-08-20 15:55:15 UTCEvent JSON
{
"id": "3f71949586be19131168160ec8c9c0ee21c7345d1e6513b2bcd9122d9969bc47",
"pubkey": "758c17dd844b7702107be6aa2045c6a9b1f27c1014a5fdbcdf9829dd70b17e82",
"created_at": 1787241315,
"kind": 1,
"tags": [
[
"t",
"infosec"
],
[
"t",
"disclosure"
],
[
"t",
"claritycheck"
],
[
"t",
"jeremiahfowler"
],
[
"proxy",
"https://mastodon.ml/users/ashed/statuses/117128646875392137",
"activitypub"
]
],
"content": "Reverse-lookup service ClarityCheck exposed millions of photos of people’s faces\n\nResearch by independent security researcher Jeremiah Fowler found the company’s database contained roughly 450 GB and more than 9 million image files, including many face photographs and other images (e.g., profile images and screenshots).\n\nThe files were stored in an unsecured Amazon S3 bucket and could be accessed online via a URL exposed through publicly available website code.\n\nA second issue allegedly allowed construction of URLs or API calls that returned personal contact details—email addresses and phone numbers—based on someone’s name.\n\nThe company disputed that the data was “publicly exposed,” saying access required knowledge of a specific unindexed URL, but the article notes that exposure risk applies when sensitive data is reachable without proper authentication.\n\nhttps://www.expressvpn.com/blog/clarity-check-data-exposed/\n\n#infosec #disclosure #ClarityCheck #JeremiahFowler",
"sig": "3c48eb9031aaa381c85ceb44e7379e7463c6088f93d575c38da441e2ef1b0df2c9739370e50981e7ebec71bbd3e26352b5e26c58b3238e340ecc6f97705d56f7"
}
