In Denmark, a CPR number (short for Det Centrale Personregister, or Central Person Register) is a unique 10-digit personal identification and social security number assigned to every resident and citizen.
Equivalent to social security information in the US I guess.
You're contradicting yourself, how can it be unique if only 1000 can be assigned per given date of birth? What if more than one thousand babies are born in the country one day?
For some unknown reason, the SSN in USA is assumed to be secret. You go to the bank, say SSN=12345 and they give you a million dollars and then send the collector the the guy/gal with that number, and call it identity thief instead of bad bank security or fraud.
Here in Argentina, the DNI is assumed to be public, it appears in a lot of public documents next to your name, and on election day there is a list of all the local voters with name and DNI at the door of the pooling site. To pay a sweater in two installments you may need to present the phisical DNI card and a water or electricity bill and they photocopy all of them.
I'm not super familiar with SSN in US of A, but I think the Danish one is not has secret. Don't get me wrong, the leak is not good, but there is a limit to what you can do with it.
Targeted and real looking spam mails come to mind. Hey <NAME> with <Address> and <CPR>, you have to log in <fake government website> to verify X Y Z.
Apparently some pay day loans or similar with just CPR + name is or was a thing. But lets hope that will change now. Bonkers as CPR should be be treaded as a secret.
Fingers crossed this late sequel parody somehow duplicates the original's charm. It would be embarrassing for Disney if it's better written/received than their own attempt with the source material.
My first thought was "maybe security compliance training should include mandatory screening of Spaceballs"
Which does remind me of my game theory class in college... the professor would show movie scenes that demonstrated the game model we would be studying that week. It was quite effective, and certainly helped keep me engaged.
For 1-2 years now strictly IT companies are on Copilot, non strictly IT companies on autopilot, and in neither case there are any pilots. Hopefully the default installation and configuration of everything will solve all your problems because there is nothing else.
I’m less shocked than I should be. National ID registries can be incredibly convenient, but when something goes wrong, it can go terribly wrong. Despite my general misgivings, I hope the IT company is visibly held accountable.
What is terribly wrong with it? Society needs more transparency, not more closedness. Closedness breeds mistrust. Corruption grows in darkness.
Most companies have open internal directory services, you can see who works there and contact them easily. Why should that not be the case for entire societies?
David Brin was on to something with "The Transparent Society".
The question really becomes: why do so many organizations seem to know absolutely nothing about well-publicized and well-documented best practices? How does a government completely lack controls or oversight for basic competence?
Its interesting, while private companies just blast our data out there, I cannot install the software I need to do my work because the state IT provider blocks it on security grounds. Its all very tiresome.
I think that the third parties who have been granted access to the civil registry should be audited on a regular basis for the “best practices” of the day. Similar to the participants of the payment systems like VISA or MC that are regularly audited for PCI standards.
I wouldn't the blame the guy. The security teams tend to serve entirely security related goals only, and they don't hesitate to stop all activity, if they are allowed to, to ensure the highest level of security. On the other side, there are people who have goals for productivity and getting work done. They don't hesitate to take the shortest route possible to maximize their productivity. If productivity is not your goal, then security is not my goal.
It's tussle between two counter-acting forces at play. This get's worse when the overarching authority that supervises both departments, has no clue about how to hit a balanced prioritization. For example, security teams rule the financial companies, like mafia bosses. No one, including CEO, can dare to question why so many layer of security is needed.
> It's tussle between two counter-acting forces at play.
It really doesn't have to be, and setting things up as adversarial is counter-productive. Pretending that you're "balancing" two competing alternatives when they may not even be opposed is a problem, it gets you C++ std::span, a type which was standardized to be pointlessly dangerous because hey, surely if it's less safe that will make it faster right? [Morgan Freeman's Voice: But it was not faster]
You are presenting a false dilemma (probably unintentionally). While security can be at odds with usability, basic measures like password generation and management are a solved problem. In fact using password manager is more convenient than typing password manually, even 123456 :)
It’s worth noting that they still had to kidnap the princess to find out the password. It could have been anything and wouldn’t have made a difference, it’s still vulnerable to the $10 wrench.
Next step in typical security team fashion: Prevent password managers from working, by obscuring the password field, using click-to-type passwords or similar shenanigans, because fuck you, that's why...
Unless of course, you need to unlock your password manager, which is not integrated with your browser, because corporate IT doesn't allow browser extensions or desktop apps so you're bound to a web app ...
Until security forces the password manager session to expire after 1 hour, and forces the master password to be 16 char long with a combination of lower, upper, digit, punctuation, moon phase, astrological sign. And then they force you to change it every 2 months, and you can't reuse it until the next time Halley's comet is in the solar system.
You're missing the systemic problem the parent is talking about.
None of those hypotheticals apply in a company where "123456" was allowed as a password to begin with.
And if even if they did, which of these two is easier?
1. Typing your 16 char password with the current moon phase once an hour, and remembering the new one every time a comet passes
2. Pressing your password manager keyboard shortcut (or tapping your yubikey) once an hour, the exact same action that never changes for the rest of your life
Setting '123456' as a password on any non-trivial system is not "the shortest route possible to maximize their productivity." It would be setting the password as "000000"
The guys who are really into keyboard layouts would argue vehemently that 123456 is more ergonomic as it's an "inward roll" vs 6 consecutive presses of a key that aligns to the pinky
The account with the weak password was a former employee. It’s not on her/him that the account remained active and the admin password wasn't changed in the same process.
Productivity and Aesthetics could also be said to be counter acting forces. Or really anything that requires contemplation. I think the problem is in how some people define "productive". Is it productive to have significant security problems which cause more work?
It's not that hard to enable 2fa & force password manager usage. And it's not that hard to use it. In fact a pw manager alone is much more convenient than remembering passwords. The only people I know who "can't remember their passwords and are locked out" are people who don't use the pw manager and have dogs*it passwords with tiny variants they forget. They often need multiple attempts to log in anywhere. Yeah 2fa & pw manager is a tick more complicated but it's not like it take hours, it takes minutes per day. And you protect against stuff like this. No sympathy, sorry.
Sorry, if your job title implies even a smidgen of security responsibility, you deserve to be fired for "123456" as your password. The person who was an administrator would fall under this label. Besides, "If productivity is not your goal, then security is not my goal." is what results in draconic security measures, because employees can't be trusted AT ALL. I really don't understand your comment.
* The non-password at a two-person IT company (Pays ApS)
* And then completely unchecked access to the CPR database for 22 days which apparently does not have monitoring or limits if someone tries to access all the records (they must have made some 16k downloads per hour).
There's also the weakness that the security relies ok this information being secret. Denmark make use the personal numbers for a form of authentication, but the numbers are readable to many people. In sweden, this data is public by design. Authentication happens using public/private key and other secure mechanisms.
Just to expand slightly on this: Some old procedures, probably from the main frame age, live to this day in old institution, including the belief that you can ask people about their personal number over the telephone and auth them that way.
I don't think any IT infrastructure is doing it, it's all by a national single-sign on system.
I will expand a bit further - all the data that was compromised in this breach is public by design in sweden, as far as I know. Not just the personal numbers.
The "fun" part is that it was only caught because the bill for the lookups was higher than expected. Had the attackers done a lookup every now and then, nobody would have noticed.
Apparently no one cares, until it becomes a financial issue. IT professionels have pointed out that the system is deeply flawed for 15 - 20 years, at least, but every issue has been papered over with more IT, tweaks to software and websites. The fundamental issues have never been addressed.
The average Dane doesn't even care. They'll just complain that they need to scan their health card, rather than shouting their CPR number across the pharmacy. Thousands of people have access to the system every day, abuse happens daily, but no one seems to care, because there hasn't been an actual costs associated with that abuse.
With a few exceptions, the usefulness of the number is also just quite limited already. It's a unique identifying number, not a secret password. The problem is that it used to be considered quite secret, and you could do things like take up a loan over the phone using just your name and CPR number - which obviously got abused by scammers.
This leak is bad because there are still places and people who don't understand that producing a valid CPR number is not proof of anything.
I'd add missing MFA as weakness number three, at minimum.
Problem number 4 is that the "password" was leaked, and the company (Pays ApS) didn't figure that out.
Problem number 5 - the "password" belonged to a _former_ employee. How was that account not disabled?
Problem number 6 - how can a company with two employees get access to this register in the first place? Don't they need to show compliance with some security standard that would be not possible to deliver for such a small company?
If you start thinking more about this, more and more problems pop up.
It's easy to blame the individual users but any system (designed by incompetent people) that accepts such a password as valid deserves whatever compromise it gets.
Im sorry I know Im getting old but I say everyone is responsible. From the press who might focus too much on the whistleblower, to the poeple who OKed the company for 3rd party access, to the team responsible for regulation to the person who didnt order further checks.
I dont understand why there is not massive reorganisations in systems when things go wrong. Its always , oh yeah so we fired the guy furthest down the ladder.
You might think Im being weird, but after living many years in corporate the amount of times you see some major thing go wrong and some random guy get fired for it - often the dude who found/highlighted the problem, is crazy. Its just moral/leadership decay.
I wouldn't have made this comment but I see comments with people empathising with certain individuals in cases like this, when the way to be nice is to overhaul the system of checks and people responsible and spread the blame, fixing the domain.
> I asked them to do a thing, but didn't intend the obvious consequences* so it's not my fault they occurred.
And now we have the same thing but the bosses 'hire' AI.
Now I realise this is part of how unusual my thinking is.
I'm happy to use phrases like "ChatGPT hacked out of the sandbox, then hacked into HuggingFace"; people often respond to this like I'm suggesting OpenAI isn't at fault, and like, that's not my position at all, so far as I'm concerned the buck still stops with the person who set the task regardless, the thing that changes from incidents like this is now nobody in the future gets to even have the excuse "oh but we didn't know it could even do that" or "we didn't know it might interpret our orders in that kind of way".
The response, both when a human messes up and now when an AI messes up, needs to be defence in depth: someone giving orders needs to be giving clear orders, entities (human or machine) who follow instructions need to have not just an understanding of how to follow them, but also what's so out of scope as to be forbidden - the difference between 'follow orders' and 'follow lawful orders'.
You have a very engineer-like approach, like if you draw the line from A to B everything will work fine. Real world is different though. Humans will blissfully ignore the orders, business analysis is a lost cause since decades, and AI is built on human knowledge so guess what it will keep doing. Now what? How do we build systems without assuming complete adherence, but tolerating imperfection and failures? Isn't there some discipline teaching us that?
I indeed have a engineer-like approach, but engineering absolutely does not assume draw line from A to B and expect that's enough:
Real world, as you say, not so simple. Everything has to deal with certain degree of forecastable nonsense, e.g. a bridge has to cope not only with traffic and winds, but the possibility that someone will be drunk in charge of a ship and crash into it.
> AI is built on human knowledge so guess what it will keep doing.
Yes, and also brings its own additional mess on top of that. All machine learning takes a huge number of examples to get good, so an LLM isn't just "read all the online courses in how to run a business", but also likely has 50 business versions of the recent demonstration of common sense failure with "I live 100m from a car wash, should I walk or drive?"
> How do we build systems without assuming complete adherence, but tolerating imperfection and failures? Isn't there some discipline teaching us that?
Many such disciplines. Perhaps all except maths and computer science? Or even including maths and computer science, given stats is part of maths and even compsci has to deal with fault tolerance.
Yes and there is a reason, we are in theory, held to such higher standards. I used to think it was harder to draw the line with AI. The simple reason being when I as an engineer say something is not feasible (not not possible, just wrong and not worth doing), I could be overridden with AI. Now that we have more complex models == more money, I can draw the line with dollars and that is a language way stronger than technical feasibility to management.
Yeah that is a pretty weird opinion. Who cares about if he gets fired. He should be charged with criminal negligence and face prison time. Everyone is responsible for their own actions and its always possible to quit.
The account with the weak password was a former employee. It’s not on her/him that the account remained active and the admin password wasn't changed in the same process.
Rome wasn’t built in a day, not did it fall in a day. In a capitalist society you can gauge overall direction and success of the society but how well the market and private enterprise is doing, and well not merely in context of maximising shareholder value but as a fundamental part of the social fabric.
Because when markets aren’t doing well and you aren’t a socialist society, everything goes downhill. Look at the affordability crisis and its impact on quality of life in the west for a good example of it in practice.
If A implies B, that doesn't mean that B implies A. Having a bunch of nukes targeting every major city in the US would also make society not doing well, but that doesn't mean that society is doing well solely because there are no nuclear strikes here lately. My point is that I disagree that the market doing well necessarily implies that everything is fine.
Your point is entirely correct. Markets doing well alone is not enough, but at the same time, markets are a fundamental input to quality of life in capitalist societies. Both of these are true.
A major problem we have is that computer programming is not engineering as people like to say. An engineering discipline VALUES redundancy and is always designing for safety. Programming likes to think of itself as math, and deliberately choses less redundancy for the sake of convenience and speed. The classical example is how operating systems are written with languages that allow an index to be out of bounds. We now have systems that are glue together using bubble gum pretending to be safe, when they fail in the most horrible way when one of the links break.
> I dont understand why there is not massive reorganisations in systems
This would just replace one insecure system with another.
It is time to recognise there's no such thing as a secure connected computer. And thanks to "AI" there's no such thing even as a significant defence lead over attackers.
They way I see it, there needs to be enough slack in an organization and the timelines for major products for people to not do the bare minimum. When management pushes goal X, and pushes hard, everything else starts to decay, including security. People need enough time to do the things they know they should do, but don’t feel they have the time for. At least this is where I’ve seen a lot of issues arise.
Yes I completely agree. In the local news there was focus on which company it was and that the password was 123456.
Of all the things that failed for that leak, we should focus the LEAST on the password being insecure, and the company whom had their account misused, and the most at the other end of the long line of failures.
Why was there no monitoring on a company suddenly looking up 600 people a minute, why was this only discovered when they were making the invoice?? And how was it even possible to have a password that unsafe, no two factor auth etc etc etc.
The older the system, the higher the chance it never got a proper security audit, and/or it was built with a lot of implied trust, like most old Internet standards are.
As for 2FA, it is a nice thing to have, but it comes at a significant support cost. People lose their token, people get annoyed by the friction, people can't figure out setup (especially older folks).
We're talking about a country with 6 million inhabitants, of which a large number is old and/or barely computer-literate and/or barely actually literate. Or doesn't possess a smartphone at all and only uses government services from a public computer in a library.
Government services have to work in all these scenarios, simply because that is a right of the citizens.
Im not in tech but still in corporate. Our store went through 6 GMs in 5 years. The problem is actually the corporate, not the new guy every 8 months who is being brought on to save the day. I think they're going to replace him again next year without addressing any of the issues on the ground.
When you have bad practice and process it can erode the security discipline of everyone working within the system. Until they commit brazen crap like reusing simple passwords everywhere.
> I mean you simply don't believe it until you witness it. Its just moral/leadership decay.
I think there's also a big part of the line that Jennifer Lawrence says in the satiric comedy "Don't look up":
"They are not even smart enough to be as evil as you're giving them credit for."
Just as the person who picks 123456 as a password doesn't see where the problem is, I think there are really quite a lot of people dumb enough all along the decision chain to think that firing the person who reported the problem did actually fix the problem.
i find it is usually most useful to blame systems, not people. of course, it is usually _easiest_ to blame a person, rather than go through the hard work of redesigning the system. hence why:
> I dont understand why there is not massive reorganisations in systems when things go wrong. Its always , oh yeah so we fired the guy furthest down the ladder.
> I dont understand why there is not massive reorganisations in systems when things go wrong. Its always , oh yeah so we fired the guy furthest down the ladder.
Management should be tried for gross incompetence with some painful consequences severe enough to cause change in behavior. This is the only way.
Because everybody that wants to deflect blame off themselves pushes it down the organization, and lower levels of the organization have no real power to push that blame back up. That would require organized labor independent from company management.
It is easy to blame the company or individual responsible for making the leak possible, and of course also well justified, but I think the bigger problem is the way the CPR number is used.
Having a unique number that is needed for identifying individuals, but also often used for authentication and thus meant to be kept secret, is bound to go wrong. There are too many situations where these use cases are in conflict, and considering Denmark has MitID - a actual national authentication solution - the CPR number should have been considered public information a long time ago, and shouldn’t ever be usable for obtaining credit or the like on its own. A system keeps insisting this is sensitive information is really the main responsible here.
> Having a unique number that is needed for identifying individuals, but also often used for authentication and thus meant to be kept secret, is bound to go wrong
That's also not how they are used. They're maybe the username, but never the password, and absolutely not supposed to be secret. They are supposed to be extremely public.
I think you mean that isn’t how they are meant to be used. If that was consistently the case in practice, however, no one would talk about this leak (at least not the CPR number part of it).
I doubt the CPR number alone will give you access to obtain credit and the like today, but you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number, and you for sure can get access to a lot of data by calling various entities and providing your CPR number as proof of identity (but at least fewer now than used to be the case in the past).
If the CPR number was truly made public information, those cases would be much more obviously wrong. The fact that CPR numbers are de facto considered pseudo-secret makes things much worse.
> but you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number
You for sure can't do this in Sweden. I very much doubt Denmark has gone total nutjob on this part, but if you have some proof they do please present it.
> If the CPR number was truly made public information,
In Sweden I can just call up the tax office and ask for the person number of anyone. A colleague was as confused about this as you are and he ended up intending to "prove me wrong" by doing it. They gave him my person number. Which of course they did. That's what it's for.
Yes, but Sweden and Denmark have been very different in their approach to personal numbers, and a lot of us here in DK are looking at the Swedish model as an example of how this _should_ work.
I am not sure what evidence you are looking for, but I have myself picked up prescription medicine using nothing but my CPR number on multiple occasions, including picking it up on behalf of my wife (providing just her CPR number and name).
I'm willing to bet at least 20 DKK that a significant percentage of Danish boomers use their CPR number as their password for the digital two-factor authentication system MitID.
They do so because they don't want to forget their password.
182 comments
[ 3.3 ms ] story [ 63.1 ms ] threadEquivalent to social security information in the US I guess.
There's only 500 numbers it could be, assuming someone knows those other things about you.
In any case, there are alternative systems for authorisation.
Here in Argentina, the DNI is assumed to be public, it appears in a lot of public documents next to your name, and on election day there is a list of all the local voters with name and DNI at the door of the pooling site. To pay a sweater in two installments you may need to present the phisical DNI card and a water or electricity bill and they photocopy all of them.
Targeted and real looking spam mails come to mind. Hey <NAME> with <Address> and <CPR>, you have to log in <fake government website> to verify X Y Z.
Apparently some pay day loans or similar with just CPR + name is or was a thing. But lets hope that will change now. Bonkers as CPR should be be treaded as a secret.
Like the recent ransomware attack on a Swedish Svedala municipality, still no root cause published on that?
Fingers crossed this late sequel parody somehow duplicates the original's charm. It would be embarrassing for Disney if it's better written/received than their own attempt with the source material.
Which does remind me of my game theory class in college... the professor would show movie scenes that demonstrated the game model we would be studying that week. It was quite effective, and certainly helped keep me engaged.
Most companies have open internal directory services, you can see who works there and contact them easily. Why should that not be the case for entire societies?
David Brin was on to something with "The Transparent Society".
Since then I think medical data science is mainly a waste of tax payer's money.
It's tussle between two counter-acting forces at play. This get's worse when the overarching authority that supervises both departments, has no clue about how to hit a balanced prioritization. For example, security teams rule the financial companies, like mafia bosses. No one, including CEO, can dare to question why so many layer of security is needed.
> According to Denmark’s Central Business Register, Pays ApS had two employees as of July 2026.
It really doesn't have to be, and setting things up as adversarial is counter-productive. Pretending that you're "balancing" two competing alternatives when they may not even be opposed is a problem, it gets you C++ std::span, a type which was standardized to be pointlessly dangerous because hey, surely if it's less safe that will make it faster right? [Morgan Freeman's Voice: But it was not faster]
You're missing the systemic problem the parent is talking about.
And if even if they did, which of these two is easier?
1. Typing your 16 char password with the current moon phase once an hour, and remembering the new one every time a comet passes
2. Pressing your password manager keyboard shortcut (or tapping your yubikey) once an hour, the exact same action that never changes for the rest of your life
True.
> And if even if they did, which of these two is easier?
You didn't understand their point. The password manager itself locks and tapping doesn't work until you put in the master password again.
Or if your boss has pointy hair.
"Ackshually..."
One side wanting us to automate things. And the other refusing us api access to the keyvault.
* The non-password at a two-person IT company (Pays ApS)
* And then completely unchecked access to the CPR database for 22 days which apparently does not have monitoring or limits if someone tries to access all the records (they must have made some 16k downloads per hour).
I don't think any IT infrastructure is doing it, it's all by a national single-sign on system.
The CPR alone is used for casual identification.
Apparently no one cares, until it becomes a financial issue. IT professionels have pointed out that the system is deeply flawed for 15 - 20 years, at least, but every issue has been papered over with more IT, tweaks to software and websites. The fundamental issues have never been addressed.
The average Dane doesn't even care. They'll just complain that they need to scan their health card, rather than shouting their CPR number across the pharmacy. Thousands of people have access to the system every day, abuse happens daily, but no one seems to care, because there hasn't been an actual costs associated with that abuse.
This leak is bad because there are still places and people who don't understand that producing a valid CPR number is not proof of anything.
If you start thinking more about this, more and more problems pop up.
I dont understand why there is not massive reorganisations in systems when things go wrong. Its always , oh yeah so we fired the guy furthest down the ladder.
You might think Im being weird, but after living many years in corporate the amount of times you see some major thing go wrong and some random guy get fired for it - often the dude who found/highlighted the problem, is crazy. Its just moral/leadership decay.
I wouldn't have made this comment but I see comments with people empathising with certain individuals in cases like this, when the way to be nice is to overhaul the system of checks and people responsible and spread the blame, fixing the domain.
I asked them to do a thing, but didn't intend the obvious consequences* so it's not my fault they occurred.
And now we have the same thing but the bosses 'hire' AI.
Now I realise this is part of how unusual my thinking is.
I'm happy to use phrases like "ChatGPT hacked out of the sandbox, then hacked into HuggingFace"; people often respond to this like I'm suggesting OpenAI isn't at fault, and like, that's not my position at all, so far as I'm concerned the buck still stops with the person who set the task regardless, the thing that changes from incidents like this is now nobody in the future gets to even have the excuse "oh but we didn't know it could even do that" or "we didn't know it might interpret our orders in that kind of way".
The response, both when a human messes up and now when an AI messes up, needs to be defence in depth: someone giving orders needs to be giving clear orders, entities (human or machine) who follow instructions need to have not just an understanding of how to follow them, but also what's so out of scope as to be forbidden - the difference between 'follow orders' and 'follow lawful orders'.
Real world, as you say, not so simple. Everything has to deal with certain degree of forecastable nonsense, e.g. a bridge has to cope not only with traffic and winds, but the possibility that someone will be drunk in charge of a ship and crash into it.
> AI is built on human knowledge so guess what it will keep doing.
Yes, and also brings its own additional mess on top of that. All machine learning takes a huge number of examples to get good, so an LLM isn't just "read all the online courses in how to run a business", but also likely has 50 business versions of the recent demonstration of common sense failure with "I live 100m from a car wash, should I walk or drive?"
> How do we build systems without assuming complete adherence, but tolerating imperfection and failures? Isn't there some discipline teaching us that?
Many such disciplines. Perhaps all except maths and computer science? Or even including maths and computer science, given stats is part of maths and even compsci has to deal with fault tolerance.
That’d be engineering.
Otherwise shareholders do not care, because they do not have skin in the game.
Same for government staff. Unless they are explicitly fired there are no consequences of abusing the trust of public.
... said every "security" pedlar ever.
Because when markets aren’t doing well and you aren’t a socialist society, everything goes downhill. Look at the affordability crisis and its impact on quality of life in the west for a good example of it in practice.
Because massive reorganisations can easily lead to even more things going wrong. Also most people are lazy and phlegmatic by default.
This would just replace one insecure system with another.
It is time to recognise there's no such thing as a secure connected computer. And thanks to "AI" there's no such thing even as a significant defence lead over attackers.
Of all the things that failed for that leak, we should focus the LEAST on the password being insecure, and the company whom had their account misused, and the most at the other end of the long line of failures.
Why was there no monitoring on a company suddenly looking up 600 people a minute, why was this only discovered when they were making the invoice?? And how was it even possible to have a password that unsafe, no two factor auth etc etc etc.
As for 2FA, it is a nice thing to have, but it comes at a significant support cost. People lose their token, people get annoyed by the friction, people can't figure out setup (especially older folks).
Government services have to work in all these scenarios, simply because that is a right of the citizens.
Our system now heavily reenforces lack of accountability to executives for what happens under their watch.
Investors don't lose money when these breaches happen.
This is why it won't change until those change.
I think there's also a big part of the line that Jennifer Lawrence says in the satiric comedy "Don't look up":
"They are not even smart enough to be as evil as you're giving them credit for."
Just as the person who picks 123456 as a password doesn't see where the problem is, I think there are really quite a lot of people dumb enough all along the decision chain to think that firing the person who reported the problem did actually fix the problem.
They are really that dumb.
> I dont understand why there is not massive reorganisations in systems when things go wrong. Its always , oh yeah so we fired the guy furthest down the ladder.
Management should be tried for gross incompetence with some painful consequences severe enough to cause change in behavior. This is the only way.
Thieves give it back now!
Having a unique number that is needed for identifying individuals, but also often used for authentication and thus meant to be kept secret, is bound to go wrong. There are too many situations where these use cases are in conflict, and considering Denmark has MitID - a actual national authentication solution - the CPR number should have been considered public information a long time ago, and shouldn’t ever be usable for obtaining credit or the like on its own. A system keeps insisting this is sensitive information is really the main responsible here.
That's also not how they are used. They're maybe the username, but never the password, and absolutely not supposed to be secret. They are supposed to be extremely public.
I doubt the CPR number alone will give you access to obtain credit and the like today, but you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number, and you for sure can get access to a lot of data by calling various entities and providing your CPR number as proof of identity (but at least fewer now than used to be the case in the past).
If the CPR number was truly made public information, those cases would be much more obviously wrong. The fact that CPR numbers are de facto considered pseudo-secret makes things much worse.
In Norway I have to show photographic ID and my fødselsnummer.
You for sure can't do this in Sweden. I very much doubt Denmark has gone total nutjob on this part, but if you have some proof they do please present it.
> If the CPR number was truly made public information,
In Sweden I can just call up the tax office and ask for the person number of anyone. A colleague was as confused about this as you are and he ended up intending to "prove me wrong" by doing it. They gave him my person number. Which of course they did. That's what it's for.
I am not sure what evidence you are looking for, but I have myself picked up prescription medicine using nothing but my CPR number on multiple occasions, including picking it up on behalf of my wife (providing just her CPR number and name).
They do so because they don't want to forget their password.