> just tax id, which in Brazil nowadays doesn't mean much

Fraudsters can go as far as opening bank accounts with that information, take loans an disappear, I don't know what you mean with "doesn't mean much". Not every brazilian is in "BC Protege", which would prevent this.

Also the fact that it has been leaked before does not diminish what has happened here, maybe the new bad actors did not have access to previous information.

▲

onemoresoop a day ago | parent | next [-]

But who would be affected, the institutions or the actual customers whose information was leaked? Any fraudulent activity based on the leaked information cannot be directly blamed on the customers themselves and should be a problem the institutions to be stuck with and solve.

	▲	tredre3 a day ago \| parent [-]
		You're not looking at the full picture. Of course customers ultimately won't be responsible. But they might have to spend weeks/months/years fighting multiple systems for those accounts/charges/debts to be removed from their names. And just when you think it's solved, there's another one! Anyone who's been through this will tell you that it's very stressful and time consuming, unfortunately.

▲

matheusmoreira a day ago | parent | prev [-]

People are seriously underestimating the impact of these leaks.

I've had government websites authenticate me by CPF and birth date on my first login. These government people made this and thought there was nothing wrong with it, it's literally in production right now.

▲

brabel a day ago | parent | next [-]

You are likely misunderstanding what happened. Government websites usually let you use your gov.br app to authenticate and that uses your CPF as username. But it has a hardware stored certificate that identifies you, you don't need a password because it's presenting a cryptographic certificate instead, which is much, much more secure.

▲

matheusmoreira a day ago | parent [-]

The Nota Fiscal website has three access methods: user/password, digital certificate and gov.br account.

I chose the user/password method, and went through their "first access" flow to set up my account. I was asked for my CPF, birth date and some other tax number I don't remember. That was it.

The "much, much more secure" option literally doesn't matter when I can literally bypass it with birth dates and some other tax minutiae that anyone in my accountant's office can get their hands on.

▲

a day ago | parent | next [-]

[deleted]

▲

MichaelZuo a day ago | parent | prev [-]

So then are the other HN users here who seemingly dont understand the concept of weakest link in the chain just trolling? fools?

Because what your saying implies the breach is in fact extremely serious for many Brazilians…

	▲	matheusmoreira a day ago \| parent [-]
		The "forgot password" flow prompts me for the exact same information, by the way. Only reason it's secure is it sends the usual password reset email to my actual email. Were it not for that, anyone on my accountant's office would have the ability to take over my account at any time. This particular breach isn't all that serious, but there have already been breaches so extensive that entire databases worth of financial and marketing information on every Brazilian citizen have made it to darknet sites and are already up for sale. https://cyberbrics.info/the-largest-personal-data-leakage-in... > names, unique tax identifiers, facial images, addresses, phone numbers, email, credit score, salary and more > 223 million Brazilians > 104 million vehicle records > literally all types of personal data you may think of, plus many you are not really thinking about > ID number, marital status, and list of all first-degree relatives (parents, son or daughter, siblings, spouse), complete home address (including latitude and longitude), credit score, voter registration number, profession, and even link to LinkedIn profile > level of education, salary, income, purchasing power Authenticating Brazilians via random bits of personal information like date of birth in 2026 is just total insanity.

▲

drdexebtjl a day ago | parent | prev | next [-]

Name and shame the government website that does this.

▲

matheusmoreira a day ago | parent [-]

My most recent interaction with a government website that did this: Nota Fiscal.

Didn't have an account, so I had to go through their "first login" flow where it demanded my CPF, birth date and some other tax number thing I don't quite remember. That's all it takes to "verify" my identity, apparently.

It's a system that rolled out nationwide some time ago. I was forced to migrate to it after my city's nota fiscal system was deprecated. Don't remember if the local system was better or worse: my accountant signed up for it, not me.

Honestly, I don't even want them to fix any of this at this point. If they try, I have no doubt they'll double down on the surveillance and mandate facial recognition instead. And when people inevitably start deep faking it with AI, I have no doubt they'll destroy computer freedom because of it by requiring that everybody be restricted to locked down government approved phones.

▲

marcosdumay a day ago | parent | next [-]

> some other tax number

I imagine your voter registration. That one is a very "secretive" number, since people used to use it to commit voter fraud by the 80s and 90s.

Anyway, that's a site where you register to report and pay taxes. It's not something other people will rush to do in your name. There is usually extra security on the services that provide stuff that people actually want.

▲

matheusmoreira a day ago | parent [-]

> Anyway, that's a site where you register to report and pay taxes.

No, it's a government website where you generate invoices so that other people can pay you for services rendered. Every businessman needs to deal with this bureaucracy.

> It's not something other people will rush to do in your name.

Anyone who impersonates me and gets into this system could launder money through my business.

▲

drdexebtjl a day ago | parent [-]

You need a digital certificate to generate invoices.

The worst an impersonator who got into this system could do is see all of the invoices of services provided to you or your business.

Which is also bad, but not nearly as bad.

	▲	matheusmoreira a day ago \| parent [-]
		> You need a digital certificate to generate invoices. Not at all. I don't have any digital certificates, and I still generate my invoices every month.

▲

drdexebtjl a day ago | parent | prev [-]

Interesting. I also went through this sign up recently and thought it was weird that it didn’t require gov.br.

But it asked me for my voter ID and the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got (read-only permissions of tax documents). Write permissions required a digital certificate.

I will report this :)

	▲	matheusmoreira a day ago \| parent [-]
		There is a gov.br and digital certificate option, but they are not mandatory. > the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got I see. I wouldn't call them "very secret". All of my accountants have access to this information, as do several of my family members. I wouldn't be surprised if those things eventually leaked in some government breach either.

▲

alala-lala-lon a day ago | parent | prev [-]

[dead]