ClarityCheck bills its reverse-image face search as private and secure. A database holding more than 9 million photos says otherwise.
ClarityCheck runs a people-search tool that lets users upload a photo and search for matches against its stockpile of images. That database was left exposed, containing more than 9 million image files, according to Wired. The exposure directly contradicts ClarityCheck's own marketing, which describes the service in those exact terms: private and secure. It's not yet clear from Wired's reporting how long the database was open or whether anyone besides the reporters found it.
A reverse image search tool is only as useful as its database is large, and only as risky as that database is unprotected. Nine million photos tied to a people-search product means real faces attached to real identities, not sample data. The industry's pitch has always been that facial-matching tools help you find out who someone is - this incident is a reminder that the tools themselves are also a very large, very identifiable target.
Promising privacy in a press release is free. Building the infrastructure to actually keep nine million faces locked down is the part companies keep skipping.