You are likely misunderstanding what happened. Government websites usually let you use your gov.br app to authenticate and that uses your CPF as username. But it has a hardware stored certificate that identifies you, you don't need a password because it's presenting a cryptographic certificate instead, which is much, much more secure.

▲

matheusmoreira a day ago | parent [-]

The Nota Fiscal website has three access methods: user/password, digital certificate and gov.br account.

I chose the user/password method, and went through their "first access" flow to set up my account. I was asked for my CPF, birth date and some other tax number I don't remember. That was it.

The "much, much more secure" option literally doesn't matter when I can literally bypass it with birth dates and some other tax minutiae that anyone in my accountant's office can get their hands on.

▲

a day ago | parent | next [-]

[deleted]

▲

MichaelZuo a day ago | parent | prev [-]

So then are the other HN users here who seemingly dont understand the concept of weakest link in the chain just trolling? fools?

Because what your saying implies the breach is in fact extremely serious for many Brazilians…

	▲	matheusmoreira a day ago \| parent [-]
		The "forgot password" flow prompts me for the exact same information, by the way. Only reason it's secure is it sends the usual password reset email to my actual email. Were it not for that, anyone on my accountant's office would have the ability to take over my account at any time. This particular breach isn't all that serious, but there have already been breaches so extensive that entire databases worth of financial and marketing information on every Brazilian citizen have made it to darknet sites and are already up for sale. https://cyberbrics.info/the-largest-personal-data-leakage-in... > names, unique tax identifiers, facial images, addresses, phone numbers, email, credit score, salary and more > 223 million Brazilians > 104 million vehicle records > literally all types of personal data you may think of, plus many you are not really thinking about > ID number, marital status, and list of all first-degree relatives (parents, son or daughter, siblings, spouse), complete home address (including latitude and longitude), credit score, voter registration number, profession, and even link to LinkedIn profile > level of education, salary, income, purchasing power Authenticating Brazilians via random bits of personal information like date of birth in 2026 is just total insanity.