Name and shame the government website that does this.

My most recent interaction with a government website that did this: Nota Fiscal.

Didn't have an account, so I had to go through their "first login" flow where it demanded my CPF, birth date and some other tax number thing I don't quite remember. That's all it takes to "verify" my identity, apparently.

It's a system that rolled out nationwide some time ago. I was forced to migrate to it after my city's nota fiscal system was deprecated. Don't remember if the local system was better or worse: my accountant signed up for it, not me.

Honestly, I don't even want them to fix any of this at this point. If they try, I have no doubt they'll double down on the surveillance and mandate facial recognition instead. And when people inevitably start deep faking it with AI, I have no doubt they'll destroy computer freedom because of it by requiring that everybody be restricted to locked down government approved phones.

▲

marcosdumay a day ago | parent | next [-]

> some other tax number

I imagine your voter registration. That one is a very "secretive" number, since people used to use it to commit voter fraud by the 80s and 90s.

Anyway, that's a site where you register to report and pay taxes. It's not something other people will rush to do in your name. There is usually extra security on the services that provide stuff that people actually want.

▲

matheusmoreira a day ago | parent [-]

> Anyway, that's a site where you register to report and pay taxes.

No, it's a government website where you generate invoices so that other people can pay you for services rendered. Every businessman needs to deal with this bureaucracy.

> It's not something other people will rush to do in your name.

Anyone who impersonates me and gets into this system could launder money through my business.

▲

drdexebtjl a day ago | parent [-]

You need a digital certificate to generate invoices.

The worst an impersonator who got into this system could do is see all of the invoices of services provided to you or your business.

Which is also bad, but not nearly as bad.

	▲	matheusmoreira a day ago \| parent [-]
		> You need a digital certificate to generate invoices. Not at all. I don't have any digital certificates, and I still generate my invoices every month.

▲

drdexebtjl a day ago | parent | prev [-]

Interesting. I also went through this sign up recently and thought it was weird that it didn’t require gov.br.

But it asked me for my voter ID and the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got (read-only permissions of tax documents). Write permissions required a digital certificate.

I will report this :)

	▲	matheusmoreira a day ago \| parent [-]
		There is a gov.br and digital certificate option, but they are not mandatory. > the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got I see. I wouldn't call them "very secret". All of my accountants have access to this information, as do several of my family members. I wouldn't be surprised if those things eventually leaked in some government breach either.