The Nota Fiscal website has three access methods: user/password, digital certificate and gov.br account.
I chose the user/password method, and went through their "first access" flow to set up my account. I was asked for my CPF, birth date and some other tax number I don't remember. That was it.
The "much, much more secure" option literally doesn't matter
when I can literally bypass it with birth dates and some other tax minutiae that anyone in my accountant's office can get their hands on.
The "forgot password" flow prompts me for the exact same information, by the way. Only reason it's secure is it sends the usual password reset email to my actual email. Were it not for that, anyone on my accountant's office would have the ability to take over my account at any time.
This particular breach isn't all that serious, but there have already been breaches so extensive that entire databases worth of financial and marketing information on every Brazilian citizen have made it to darknet sites and are already up for sale.
> names, unique tax identifiers, facial images, addresses, phone numbers, email, credit score, salary and more
> 223 million Brazilians
> 104 million vehicle records
> literally all types of personal data you may think of, plus many you are not really thinking about
> ID number, marital status, and list of all first-degree relatives (parents, son or daughter, siblings, spouse), complete home address (including latitude and longitude), credit score, voter registration number, profession, and even link to LinkedIn profile
> level of education, salary, income, purchasing power
Authenticating Brazilians via random bits of personal information like date of birth in 2026 is just total insanity.
I chose the user/password method, and went through their "first access" flow to set up my account. I was asked for my CPF, birth date and some other tax number I don't remember. That was it.
The "much, much more secure" option literally doesn't matter when I can literally bypass it with birth dates and some other tax minutiae that anyone in my accountant's office can get their hands on.