Hacker News Reader

Comment by ptnpzwqd | Hacker News Reader

It is easy to blame the company or individual responsible for making the leak possible, and of course also well justified, but I think the bigger problem is the way the CPR number is used.

Having a unique number that is needed for identifying individuals, but also often used for authentication and thus meant to be kept secret, is bound to go wrong. There are too many situations where these use cases are in conflict, and considering Denmark has MitID - a actual national authentication solution - the CPR number should have been considered public information a long time ago, and shouldn’t ever be usable for obtaining credit or the like on its own. A system keeps insisting this is sensitive information is really the main responsible here.

View on HN

> Having a unique number that is needed for identifying individuals, but also often used for authentication and thus meant to be kept secret, is bound to go wrong

That's also not how they are used. They're maybe the username, but never the password, and absolutely not supposed to be secret. They are supposed to be extremely public.

I think you mean that isn’t how they are meant to be used. If that was consistently the case in practice, however, no one would talk about this leak (at least not the CPR number part of it).

I doubt the CPR number alone will give you access to obtain credit and the like today, but you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number, and you for sure can get access to a lot of data by calling various entities and providing your CPR number as proof of identity (but at least fewer now than used to be the case in the past).

If the CPR number was truly made public information, those cases would be much more obviously wrong. The fact that CPR numbers are de facto considered pseudo-secret makes things much worse.

> you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number

In Norway I have to show photographic ID and my fødselsnummer.

> but you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number

You for sure can't do this in Sweden. I very much doubt Denmark has gone total nutjob on this part, but if you have some proof they do please present it.

> If the CPR number was truly made public information,

In Sweden I can just call up the tax office and ask for the person number of anyone. A colleague was as confused about this as you are and he ended up intending to "prove me wrong" by doing it. They gave him my person number. Which of course they did. That's what it's for.

Yes, but Sweden and Denmark have been very different in their approach to personal numbers, and a lot of us here in DK are looking at the Swedish model as an example of how this _should_ work.

I am not sure what evidence you are looking for, but I have myself picked up prescription medicine using nothing but my CPR number on multiple occasions, including picking it up on behalf of my wife (providing just her CPR number and name).

I'm willing to bet at least 20 DKK that a significant percentage of Danish boomers use their CPR number as their password for the digital two-factor authentication system MitID.

They do so because they don't want to forget their password.

Reply on news.ycombinator.com