Firm that verifies mugshots for ChatGPT and Roblox feeds US surveillance apparatus with 269 distinct checks

Every selfie or ID you upload to ChatGPT, Roblox, LinkedIn, and many other sites for verification is handled by a San Francisco firm called Persona. A massive leak has exposed its other side – a platform capable of feeding the US government with 269 sophisticated surveillance checks on millions of users worldwide.

A security researcher at vmfunc.re, who goes by the alias Celeste, discovered exposed infrastructure belonging to Persona, the identity verification company used by ChatGPT and other major services.

Persona also runs a platform authorized by FedRAMP (Federal Risk and Authorization Management Program), offering federal agencies “to verify users’ identities” in over 200 countries, detect fraud, and ensure regulatory compliance.”

Celeste claims they obtained the entire dashboard codebase from the ONYX government deployment “app.onyx.withpersona-gov.com,” which was left unprotected and publicly exposed.

The original actual post by the researchers is here if anyone wants to know more about the actual details!

https://vmfunc.re/blog/persona/ (turn off your audio or mute the tab if you have regular speakers because it will just start randomly playing stuff if you don't lmao)

I hope this didn't come as a surprise to anyone.

We need to replace these age checks with tools that help parents/guardians block inappropriate online content for their children. Anything else is inefficient, ultimately dystopian, or both.

Never. Verify. Your. Identity. Online.