Hacker News Reader

Hacker News

Comment by user73929274 | Hacker News Reader

Full thread

user73929274

And 2019, Brazil's DMV exposed PII from 70 millions drivers [1].

1. https://olhardigital.com.br/noticia/-exclusivo-detran-vaza-d...

View on HN

We just can't assume privacy exists here in Brazil. =(

I spent a few months in São Paulo working on a project with Hospital das Clínicas.

No matter how many times I saw it, the sheer number of contests in which people and websites would ask for a CPF was astonishing.

For Americans, imagine if you were asked if you want to enter your Social Security Number at the supermarket, or when ordering online, or to sign up for a gym membership.

This is absurd. I pay sometimes almost half more in drug stores because I refuse to give my CPF number "to get a discount".

Terrible.

If you gave a made up number could they tell?

They can tell weather a CPF number is valid or not. But I have tried giving them 123.456.789-09 which is mathematically valid, but it wasn't accepted. Maybe they have a verification for the actual existence of the number.

I guess that the last two numbers are the mod 97 checksum, so it should then be 123.456.789-39.

Nah, discounts are on the 10% to 15% range, come on!

I don't know how it works in Brazil, I couldn't find any info about it through a quick search, but at least in Chile our equivalent ID number is public knowledge.

Yea, I found that strange. I wasn’t there long, but I found an insurance website which would show name/address/dob/phone number && RUT, when I entered a car / moto rego plate.

Which effectively meant any rego may as well be any / all those details. I’m sure there are plenty of other examples.

It is not a fair comparison to mention SSN, since the US law enforcement and fraud prevention not even comparable. You can ruin someone's life by exploiting their SSN, but in Brazil, the damage that can be done by knowing your CPF is way lower, specially because it is supposed to be a public number and security is implemented in other ways.

That said, yeah, the CPF can be used to do cross company identification, BI/AI/Data science and all sorts of optimizations in the marketing and can be used to scam you. But lets be honest here: Software industry in Brazil is mostly incompetent and largely lacking the expertise to make it happen. A few companies might do well using this data, but the cost is so high, for so little gain, it is completely laughable in comparison of what US companies just with your email and phone paired together.

Reply on news.ycombinator.com