A company called ClarityCheck markets itself as a tool to detect catfishing and fake dating profiles. Its website tells users: "your reverse image search is private and secure." researcher Jeremiah Fowler just found 9,042,977 images sitting in an unsecured Amazon S3 bucket acessible to anyone who knew where to look. 450 gigabytes of faces. stored in folders labeled "faces" and "profiles." adults. teenagers. children. The most concerning thing that makes this different is that most of the people in that database never used ClarityCheck. The service lets users upload someone else's photo to identify them. that means every person whose face got uploaded by a stranger, someone trying to find out who they are, where they're from, whether they're real had their biometric data indexed and stored without ever consenting to it. without ever interacting with the platform.. ClarityCheck's response after being contacted: the data was in a "temporary storage" bucket and an "ordinary member of the public" would not have come across it. the URL to the bucket was embedded in their own website's source code. Fowler also found a second misconfiguration. entering a name into a manipulated website URL returned email addresses, physical addresses, and phone numbers for anyone in their database.