"MyPuzzle: should you be scared of a game that uses AI to process your photos?
For the past week, there has been a buzz on Facebook about the MyPuzzle app. Some people raise concerns about a serious threat, especially in the aftermath of the Kyivstar hack, while others see no risks in the game.
In this post, we’ll consider the arguments of the parties and try to assess the level of threat.
"It’s been a whole week with no connection to Kyivstar… just because someone handed over their account for the attack and their accounts for the My Puzzle app, developed by who-knows-who...
“So, what’s wrong with that? They’re just simple photos.”
I don’t know about the battlefield, but we’ve lost the cyber war... as well as the war for critical thinking and media literacy."
What’s happening?
MyPuzzle is an entertainment app that uses artificial intelligence to process uploaded images. In this respect, the app doesn’t offer anything new, as the same features can be found in other applications. What sets this game apart is that it’s free and doesn’t require a complex registration process.
What we know
The developer behind the game is Novalab, a relatively unknown entity, most likely a Chinese company. Due to China’s ban of Facebook, developers employ various strategies to access users on this social network, one of which includes not disclosing information about the company.
Novalab’s website (47.88.102.188) is hosted by novalabgames.com, a Chinese “cloud” of Alibaba Cloud, a subsidiary of the Alibaba Group. You can read about it on the same Wikipedia (check the sources). Numerous applications from different developers use Alibaba Cloud services.
Concerning data collection
MyPuzzle requests access to a public photo and name, and determines the user’s country through language settings. Apart from this, it gathers the same data as other applications.
Notably, the Alibaba Group is involved in retail so don’t be surprised to see some strange adverts during the game, perhaps promoting products like a Chinese toothbrush.
What are the potential dangers?
Don’t worry! Users won’t be abducted to a mysterious black forest in a black car. In reality, the game’s level of danger is comparable to hundreds of other apps.
For example:
- The game could potentially assist developers in compiling a database of photos and user names for the creation of fake pages in the future;
- Additionally, MyPuzzle can train AI in photo processing. As of December 22, it boasted a user base of 20 million - a pretty good sample for AI training purposes;
- Presumably, users might receive personalized advertising as a result.
- On the Novalab website, it is claimed that neither the name nor the profile picture is stored or cached - https://novalabgames.com/instant_games.html. However, for a comprehensive assessment, we’ll consider the possibility that this data may be stored.
Conclusion
The safest course of action would be to avoid using any apps altogether. However, in our opinion, the hype surrounding MyPuzzle seems to create an exaggerated perception of a significant threat. It likely falls in line with other games, websites, or apps that somehow use the Big Data phenomenon to personalize advertising. The key issue here is more about users adhering to the rules of safe behaviour on the internet and their level of digital literacy, or lack thereof 
