6 ms·

> “No, we have bigger problems than that to worry about.” Pretty much that. In the "Maslow's pyramid of government-related needs", the doxxing is near the top.

> “No, we have bigger problems than that to worry about.” Pretty much that. In the "Maslow's pyramid of government-related needs", the doxxing is near the top. People are much more worried with stuff like not dying to covid, not being kidnapped, not dying in traffic, paying the dreaded Boletos (bills), etc. Internet doxxing is dwarfed by the more urgent needs. Brazilians are also sure that exactly zero things are going to be done about these leaks. Some government representative is going to say "we're going to investigate" and that's as much as we're going to get. I would love to be wrong here, by the way.

Natsu 6y ago
This says that it leaked Brazilians' name & CPF numbers. CPF being the number that people give to every random shopkeeper to enter that tax lottery. So, it's... not exactly a big secret. To do most official-type things you have to go down to the cartório with your actual ID, not just enter the number. Heck, I've been to places where you had to use one to use the free wifi. Granted, in that particular case, it didn't care if you used someone else's. I wouldn't be surprised if that was also true, elsewhere, honestly. I'm sure someone will find ways to misuse this but Brazil has bigger problems. Also, this doesn't seem to be a leak of government data, it looks like it came from Serasa Experian or one of its contractors. So yeah, I tend to agree with you. If the government does something, it will probably be like that law posted on every elevator warning you to check that there's an actual elevator there, instead of just walking into the empty shaft. For those curious, that'd be lei estadual n^o 9.502 de 11/03/1997 - https://www.al.sp.gov.br/norma/?id=9419 https://www.al.sp.gov.br/norma/?id=9419
- Swizec 6y ago
  Reminds me of the American SSN. ”This number is super secret and you must guard it with your life and never share! Oh also write it down on every semi-official form, send by paper mail, and enter into all sorts of webapps”
  - vmception 6y ago
    I dont bother being secretive about SSN, its security theatre. The person in earshot has a lower likelihood of bothering with it when every service provider that also has it will get mass hacked and are the primary targets. I use a separate TIN or EIN (Tax/Employer Identification Number) where I can. All my businesses have one, even a sole proprietorship that exists purely in your head can obtain one, and this can go on many forms.
    - mixmastamyk 6y ago
      Interesting, if you get paid on another TIN does it effectively become your main SSN? What about at retirement time? Would like to hear more about this.
      - vmception 6y ago
        “Effectively become your main SSN” no but loaded question. less places would have your ssn or tin. the only difference it really makes is peace of mind and relying on the current reality that hackers aren't targeting you or anyone specifically and you will have an additional way to verify yourself if someone did try to do identity theft or whatever you’re worried about. Online People databases will still be reporting pieces of your older SSN while you have been primarily giving services a different number. retirement time isnt a problem. if your business is getting paid and the person that pays needs your tin/ein then thats what they get instead of your ssn. You are still paying self employment taxes contributing to retirement.
      - jccooper 6y ago
        EINs don't accumulate Social Security, but when you file taxes you'll pay "self-employment tax" on earnings from that "business" and those go to your personal SS account. When you use an EIN you're basically claiming to act as a business. For some cases, you can do that just fine. But a lot of SSN requests for identification or credit checks it won't work. And anyone who cares that it's a SSN vs a TIN can figure that out easily.
  - Wowfunhappy 6y ago
- ascorbic 6y ago
  The CPF is quite annoying as a tourist. Mostly there are workarounds, but it is ridiculous how many things assume you have one. Yes, fake ones usually work. It was a few years back when I visited, but the hoops I had to jump through to buy an internal flight was unbelievable. I mean, the idea that a non-resident might want to travel within the country on a budget airline right??
  - Natsu 6y ago
    Yeah, I hear you. Technically, anyone can get one, though I believe it comes with some annoying tax obligations, so it's not really something one would do as a tourist.
    - aflag 6y ago
      You can even get multiple numbers if you want. Though I think you're not supposed to.
      - cesarb 6y ago
        > multiple numbers At least it's not as wonky as our identity card number. For those who don't know, since our identity cards are emitted by the state governments, instead of the federal government, in theory a single person can have 27 different identity cards, one for each of the 26 states plus the federal district; all of them are valid in the whole country (and beyond, since some Mercosul treaties allow using the identity card instead of the passport).
        Natsu 6y ago
        That's why there are all those proposals for a Cadastro Único (CU) that would fix this, right? :)
- brwolfgang 6y ago
  Not just CPF and names were leaked, lots of correlated information was leaked too, such as credit scores, civil status (married, single, etc), gender, birth date, e-mail, phone number, home and work addresses, education level, job, salary, net income, tons of data about bank accounts, even face pictures! All that data, just available for anyone to dig in and do their worst. Source (pt-br) https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-220-milhoes-de-brasileiros-e-pior-do-que-se-pensava/ https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-2...
  - rodolphoarruda 6y ago
    Yes, plenty of data for anyone wanting to impersonate you and do social engineering virtually everwhere in the Brazilian territory.
    - cutemonster 6y ago
      Or find people nearby with a bit money and rob them?
  - Natsu 6y ago
    Yeah, that's a bit more concerning. I only wanted to make the point that CPF is used very differently from how SSNs are used in the USA.
- whzinn 6y ago
  Alguem têm o link de download do vazamento?
lukasdanin 6y ago
Unfortunately, you're not wrong.
Kaze404 6y ago
We must live in very different parts of Brazil because around these parts no one seems to care about Covid, which doesn't surprise me considering the message we get from the federal government.
kurthr 6y ago
Oh, no. It seems much more useful than that. By knowing credit, salary, age, and address... it's much easier to target high "value" targets for for on-line, or more likely in Brazil in person burglary or home invasion. This also gives cover to individuals banks and other organizations to drain large accounts by "guessing" passwords, since now it could be "anyone". Like Covid, this is likely to be another generational wealth transfer event. It will be interesting to see how much stays in the country, but I expect most of it will.

Natsu 6y ago

This says that it leaked Brazilians' name & CPF numbers. CPF being the number that people give to every random shopkeeper to enter that tax lottery. So, it's... not exactly a big secret. To do most official-type things you have to go down to the cartório with your actual ID, not just enter the number. Heck, I've been to places where you had to use one to use the free wifi. Granted, in that particular case, it didn't care if you used someone else's. I wouldn't be surprised if that was also true, elsewhere, honestly. I'm sure someone will find ways to misuse this but Brazil has bigger problems. Also, this doesn't seem to be a leak of government data, it looks like it came from Serasa Experian or one of its contractors. So yeah, I tend to agree with you. If the government does something, it will probably be like that law posted on every elevator warning you to check that there's an actual elevator there, instead of just walking into the empty shaft. For those curious, that'd be lei estadual n^o 9.502 de 11/03/1997 - https://www.al.sp.gov.br/norma/?id=9419 https://www.al.sp.gov.br/norma/?id=9419

Swizec 6y ago
Reminds me of the American SSN. ”This number is super secret and you must guard it with your life and never share! Oh also write it down on every semi-official form, send by paper mail, and enter into all sorts of webapps”
- vmception 6y ago
  I dont bother being secretive about SSN, its security theatre. The person in earshot has a lower likelihood of bothering with it when every service provider that also has it will get mass hacked and are the primary targets. I use a separate TIN or EIN (Tax/Employer Identification Number) where I can. All my businesses have one, even a sole proprietorship that exists purely in your head can obtain one, and this can go on many forms.
  - mixmastamyk 6y ago
    Interesting, if you get paid on another TIN does it effectively become your main SSN? What about at retirement time? Would like to hear more about this.
    - vmception 6y ago
      “Effectively become your main SSN” no but loaded question. less places would have your ssn or tin. the only difference it really makes is peace of mind and relying on the current reality that hackers aren't targeting you or anyone specifically and you will have an additional way to verify yourself if someone did try to do identity theft or whatever you’re worried about. Online People databases will still be reporting pieces of your older SSN while you have been primarily giving services a different number. retirement time isnt a problem. if your business is getting paid and the person that pays needs your tin/ein then thats what they get instead of your ssn. You are still paying self employment taxes contributing to retirement.
    - jccooper 6y ago
      EINs don't accumulate Social Security, but when you file taxes you'll pay "self-employment tax" on earnings from that "business" and those go to your personal SS account. When you use an EIN you're basically claiming to act as a business. For some cases, you can do that just fine. But a lot of SSN requests for identification or credit checks it won't work. And anyone who cares that it's a SSN vs a TIN can figure that out easily.
- Wowfunhappy 6y ago
ascorbic 6y ago
The CPF is quite annoying as a tourist. Mostly there are workarounds, but it is ridiculous how many things assume you have one. Yes, fake ones usually work. It was a few years back when I visited, but the hoops I had to jump through to buy an internal flight was unbelievable. I mean, the idea that a non-resident might want to travel within the country on a budget airline right??
- Natsu 6y ago
  Yeah, I hear you. Technically, anyone can get one, though I believe it comes with some annoying tax obligations, so it's not really something one would do as a tourist.
  - aflag 6y ago
    You can even get multiple numbers if you want. Though I think you're not supposed to.
    - cesarb 6y ago
      > multiple numbers At least it's not as wonky as our identity card number. For those who don't know, since our identity cards are emitted by the state governments, instead of the federal government, in theory a single person can have 27 different identity cards, one for each of the 26 states plus the federal district; all of them are valid in the whole country (and beyond, since some Mercosul treaties allow using the identity card instead of the passport).
      - Natsu 6y ago
        That's why there are all those proposals for a Cadastro Único (CU) that would fix this, right? :)
brwolfgang 6y ago
Not just CPF and names were leaked, lots of correlated information was leaked too, such as credit scores, civil status (married, single, etc), gender, birth date, e-mail, phone number, home and work addresses, education level, job, salary, net income, tons of data about bank accounts, even face pictures! All that data, just available for anyone to dig in and do their worst. Source (pt-br) https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-220-milhoes-de-brasileiros-e-pior-do-que-se-pensava/ https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-2...
- rodolphoarruda 6y ago
  Yes, plenty of data for anyone wanting to impersonate you and do social engineering virtually everwhere in the Brazilian territory.
  - cutemonster 6y ago
    Or find people nearby with a bit money and rob them?
- Natsu 6y ago
  Yeah, that's a bit more concerning. I only wanted to make the point that CPF is used very differently from how SSNs are used in the USA.
whzinn 6y ago
Alguem têm o link de download do vazamento?

lukasdanin 6y ago

Unfortunately, you're not wrong.

Kaze404 6y ago

We must live in very different parts of Brazil because around these parts no one seems to care about Covid, which doesn't surprise me considering the message we get from the federal government.

kurthr 6y ago

Oh, no. It seems much more useful than that. By knowing credit, salary, age, and address... it's much easier to target high "value" targets for for on-line, or more likely in Brazil in person burglary or home invasion. This also gives cover to individuals banks and other organizations to drain large accounts by "guessing" passwords, since now it could be "anyone". Like Covid, this is likely to be another generational wealth transfer event. It will be interesting to see how much stays in the country, but I expect most of it will.