alt Hacker NewsYou are likely misunderstanding what happened. Government websites usually let you use your gov.br app to authenticate and that uses your CPF as username. But it has a hardware stored certificate that identifies you, you don't need a password because it's presenting a cryptographic certificate instead, which is much, much more secure.
The Nota Fiscal website has three access methods: user/password, digital certificate and gov.br account.
I chose the user/password method, and went through their "first access" flow to set up my account. I was asked for my CPF, birth date and some other tax number I don't remember. That was it.
The "much, much more secure" option literally doesn't matter when I can literally bypass it with birth dates and some other tax minutiae that anyone in my accountant's office can get their hands on.