Article content

A company that sells the ability to identify a stranger from a photograph left more than nine million files unsecured online, a researcher found.

Article content

ClarityCheck sells reverse image searches. A user uploads a photo and the site returns names, social profiles and where else the image appears online. Canadian visitors are quoted $1.69 for a seven-day trial and $38.99 every 28 days after that.

Article content

Article content

Article content

The company also sells lookups on phone numbers, email addresses, vehicle identification numbers, names and businesses. Its homepage says it can “identify unknown callers, verify online contacts, check photos, and decode vehicles using publicly available data from trusted sources.”

Article content

Article content

Cybersecurity researcher Jeremiah Fowler found 9,042,977 image files in unsecured cloud storage belonging to the company, in folders labelled faces and profiles. The images included adults, teenagers and children, he wrote in a report published by ExpressVPN.

Article content

The site is offered in more than 20 languages and prices its trial separately for the United States, Britain, the European Union, Australia and Canada. How many of the images were Canadian is unknown.

Article content

The people in those folders are not the customers. They are the people being looked up. ClarityCheck’s image search page says the subject of a search will never be notified, and the company will pull a phone number or an email address from its results on request. It has no equivalent for a photograph.

Article content

“If you’re trying to find out who a person is, you might not have authorization or permission, so people might not know that their image had been dumped into this database that was public,” Fowler told Wired magazine.

Article content

Article content

A scammer holding those images could identify someone, build a fake profile and approach their friends and family as that person, his report said. A face cannot be reset the way a password can. ClarityCheck’s about page says its services “must not be used to stalk, harass, dox, or monitor any person.”

Article content

Article content

Fowler found the storage in early April, he said in an email to National Post. Most of the ClarityCheck addresses he tried bounced, and messages he sent through the company’s customer support did not reach the right people, he wrote. Public access was not restricted until July, after Wired contacted the company.

Article content

A ClarityCheck spokesperson told Wired access “required knowledge of a specific, unindexed URL that was not discoverable through ordinary use of the ClarityCheck service or a general web search.” The company said the files included duplicates, resized copies and non-image data rather than nine million unique images.

Article content

Fowler wrote that he did not see duplicate, cropped or resized images in the sample he reviewed, though he was not claiming they were absent. The storage URL appeared in code on ClarityCheck’s own website, Wired reported.