Password '123456' Guarded a Nation's Identity Data; Telegram Fell to a Single Click

Denmark's CPR system — the Civil Personal Registration database that functions as the country's national identity infrastructure, used for healthcare, banking, tax filing, and voting — suffered a significant data breach, and the authentication protecting sensitive records was the password '123456.' That was not a simplified description. That was the actual credential.

The HN comment section ranged from dark humor to substantive technical analysis. Several commenters noted that '123456' has topped every major 'most common password' list for well over a decade and appeared in more than 23 million breached accounts in the 2019 Have I Been Pwned dataset — making this not an obscure failure mode but a universally documented one, applied to a national identity database. CPR numbers in Denmark carry the same weight as Social Security numbers in the United States, and identity fraud enabled by their exposure can persist for years after a vulnerability is patched. The HN discussion included analysis of whether Denmark's data protection authority, Datatilsynet, would pursue enforcement under GDPR, where fines for serious violations can reach four percent of global turnover. More broadly, commenters noted that government IT systems in many countries run on aging infrastructure, maintained by contractors with varying security expertise, and often exempted from the penetration testing that private-sector organizations face — suggesting the Danish breach reflects a category of vulnerability likely present in government systems well beyond Denmark.

A separate security disclosure, scoring 200 points and drawing 95 comments, described a one-click account takeover vulnerability in Telegram Desktop. A researcher found that a malicious file delivered through Telegram's own file-sharing mechanism could, when a victim clicked a single link or opened a specific attachment, expose session credentials and grant full account control to the attacker with no additional authentication required. The vulnerability has since been patched. The disclosure renewed scrutiny of Telegram's broader security architecture: unlike Signal, Telegram does not use end-to-end encryption by default for regular chats, reserving that protection for 'Secret Chats' — a design choice that has drawn sustained criticism from security researchers and that makes a session-theft vulnerability particularly damaging to the platform's privacy-focused brand.

The week's most philosophically pointed security story involved a YouTuber who built a Flock-style automated license plate reader system and aimed it at police vehicles. Flock Safety's ALPR networks — installed on utility poles and intersections across hundreds of American cities — scan and log civilian vehicles continuously without individualized warrants, under minimal state-level legal frameworks. The YouTuber applied functionally identical technology to the cars of the agencies that operate that infrastructure. Police officers subsequently appeared at his home. The HN thread, which drew more than 300 comments, debated First Amendment dimensions, the practical legality of aggregating observations of vehicles on public roads, and what it signals about law enforcement's posture toward civilian use of surveillance technology it considers its own domain. The YouTuber's account suggested the visit was more informal message than specific legal action — which commenters noted carries its own implications.