Popsugar’s Twinning app was leaking everyone’s uploaded photos

I thought the worst thing about Popsugar’s Twinning tool was that it matched me with James Corden.

Turns out, the hundreds of thousands of selfies uploaded to the tool were easily downloadable by anyone who knew where to look.

The popular photo-matching tool is fairly simple. “It analyzes a selfie or uploaded photo, compares it to a massive database of celebrity photos to find matches, and finally gives you a ‘twinning percentage’ for your top five look-alikes,” according to Popsugar, which developed the tool. Then, you share those matched photos on Facebook and Twitter so everyone knows that you don’t look at all like one of the many Kardashians.

All of the uploaded photos are stored in a storage bucket hosted on Amazon Web Services. We know because the web address of the bucket is in the code on the Twinning tool’s website. Open that in your web browser, and we saw a real-time stream of uploaded photos.

We verified the findings by uploading a dummy photo of a certain file size at a specific time. Then, we scraped a list of filenames uploaded during that time period from the bucket’s web address, downloaded them and found our uploaded image by searching for that photo of a certain file size. (We didn’t download any more than necessary to preserve people’s privacy.)

TechCrunch did not hear back from Popsugar prior to publication, but the bucket was locked down shortly after. Later, vice-president of engineering Mike Patnode confirmed in an email that “the bucket permissions weren’t set up correctly.”

As data leaks go, this is definitely on the low-end. You might not care that their selfies were exposed and easily downloadable. (Many photos were already leaking out of Google’s search results — even before people shared their selfie matches on Twitter!) It’s not as if the site was leaking your passwords or your Social Security number. Most probably didn’t go in expecting any reasonable level of security or privacy to begin with.

But like any free app, quiz or some viral web tool, it’s worth reminding that you’re still putting your information out there — and you can’t always get it back. Worse, you almost never know how secure your data will be, or how it might end up being used — and abused — in the future.

This is Captain Buzzkill, signing off.