When someone uploads a photo to the people-search tool ClarityCheck, the website has a clear message: “Your reverse image search is private and secure.” New research, though, shows that the website left more than 9 million image files, including photographs of people’s faces, publicly exposed. And a second misconfiguration publicly exposed people’s email addresses and phone numbers.
Overall, according to findings from independent security researcher Jeremiah Fowler, the exposed ClarityCheck database contained roughly 450 GB of images, including what appeared to be profile images, screenshots, and other photographs of adults, teenagers, and children. All of the images were stored in an unsecured Amazon S3 bucket, with files in folders named “faces” and “profiles,” which could be accessed by anyone online through a URL included in the company’s publicly available website code.
ClarityCheck is one of a number of so-called people-finder tools that have appeared online in recent years. These websites broadly claim to be able to search the web, public records, and other databases to identify individuals. ClarityCheck’s website says it can run searches on phone numbers, email addresses, vehicle identification numbers, and names. Its photo-search page says it can help “identify anyone in a photo” and find social media profiles “in seconds.”
© picture alliance / Contributor
Cory Solovewicz receives more unwanted emails than you. Seriously—it’s a lot more. Since December 2024, one of the domains at which the security researcher receives email has registered 401,796 messages—by his calculations that’s an average of 699.99 pings per day.
This deluge isn’t the regular flood of spam, newsletters, and unwanted deals that fill many people’s inboxes. Instead, companies and other organizations are inadvertently sending Solovewicz other people’s private information and company secrets. Over the last few years, he’s received injury reports from a city government, confirmation of people’s pizza orders, and account setup emails from a school platform. “I get service orders for people that need repairs. I get lots of test platform credentials,” says Solovewicz, a security researcher and consultant.
Solovewicz is receiving the avalanche of messages as he’s the owner of the domains noreply.us and noreply.net, which he purchased in 2020 and 2024, respectively. After originally planning to use the noreply.us domain as a catch-all email—which receives mail sent to any @ address on that domain—to filter messages and enhance his privacy, the researcher quickly noticed that other systems were sending mail to @noreply.us addresses. “I created an accidental honeypot,” Solovewicz tells WIRED. “I had no idea it was going to turn into this.”
© Richard Drury via Getty
Age verification is consuming the Internet. From social media bans in Australia to porn restrictions in half of US states, for many having to prove their age to access websites is becoming an everyday requirement. But one of the key technologies underpinning many of these age checks is about to seep into the offline world—with potentially life-changing consequences for people having their age predicted by AI.
Starting next year, the British government is planning to introduce facial age estimation—where AI scans your face and suggests how old you are—to help determine the age of asylum seekers arriving at the United Kingdom’s border. The move is believed to be the first time that a so-called facial age estimation (FAE) system has been used in this way. Many asylum seekers arriving in the UK will not have documents proving their age, and if children are incorrectly classed as adults, they can be stripped of some legal protections and placed in adult-only detention centers.
An investigation by WIRED and Lighthouse Reports, in collaboration with The Independent, has obtained an internal UK government report detailing its tests of FAE technologies. It shows how the systems regularly mistake children for adults and appear to contain serious bias problems, which directly impact the largest group of migrants subject to age assessments in 2025, according to data from the Home Office. The investigation raises questions about the effectiveness of the technology and whether it should be deployed in such high-stakes scenarios.
© Nicolas Economou/NurPhoto via Getty Images
Login