Humble Bundle redesign removes 2FA and weakens account checks
Security issue; Humble Bundle decided to slop their new website but 'forgot' to add 2FA, meaning it's now removed from your account. At the very least change your password... which you can do without entering your previous because what even is security 👍 redd.it/1xtj3nj
PapaPandaGames75fuck even worse there is no option for deleting the account. THIS is illegal in the EU.
Devilcereal66"why do people hate AI?must be Chinese bots spreading propaganda" And lessons will continue to not be learned. If a tool is so bad that marketing you don't use the "tool" is a selling point or a nod to quality assurance then issue is the "tool"
NᴇᴜʀᴀʟSᴛᴜɴɴᴇʀ27Ah, but I had to do a Cloudflare capcha three times to log in, because that makes perfect sense.
Benjamin Cid Pérez25Please... I just want to escape the Torment Nexus for one. single. day. AAAAARGH
RHEEDOCS17This is fucked, all i can think of, is this image from a reddit thread yesterday
OrangeSky15The best (worst) part is not being able to remove payment info, so you'll need to switch it to PayPal then cut off payments on that side. Theoretically cancelling Choice removes the payment info, but hell if I'm trusting THAT. Let PayPal block it.
TAHK01013the irony of this happening while I’m getting a bunch of comments telling me vibe coding is the future of software dev
Chet Faliszek53It’s rare the vibe coding is even noticed these days cuz software all around is so bad. Do not say enshitification and think that alone is it Same song in Apple Music… sometimes I’m allowed on Apple Music to put it on endless repeat, sometimes I’m not I think devs just don’t use their own stuff
Mike Futter | Wishlist The Final Cut of Lilith Cunningham!24Ziff Davis taking the same approach to security as it does to game journalism jobs. At least they are consistent.
MrTom 👾16You can change your account email address as well, and it sends confirmation to the new email address but not the old one. SECURITY!
Andy Bell13essential to remove everything you can and stop PayPal automatically taking payments etc. unbelievably irresponsible
Grae Hall8Way to ruin a good thing by thinking you're better than doing the job properly and instead resorting to sloppy vibe coding and insufficient testing More like Hubris Bundle
Despoina [Commissions Open]7Remember how I keep saying that vibe coding will fuck up internet security and infrastructure badly? This is just a warning of what's coming.
PooterStapot6Humble Bundle for some reason: Ahhh what a good day it is today... Too good... *Tapes a screw directly under the toenail and kicks the wall* Mmmm, much better. Perhaps too much better... *Proceeds to ______* You fill out the rest. Point is, they deadass did this for no reason.
Katy1335PSA for people with Humble Bundle accounts: Humble Bundle replaced their programmers with gen ai to vibe code their website. However, the ai chatbot didn't include 2 factor authentication. So Humble Bundle no longer has 2FA. Making it a security vulnerability. Please update your password on there.
PossiblyAxolotl4Woo yeah slop it up lets slop it up in here yeah baby woo let’s let’s slop it up
Wow yeah, I just changed my password for Humble Bundle, and: 1. I did not have to enter my old password to set a new password. 2. I did not get a confirmation email that a new password was set. So, uh, if someone steals your Humble Bundle account, you won't even know it.
Robin-Yann Storm16It's not great that the official accounts haven't posted anything in a while. At least a 'We're looking into it' may be helpful here to stem the tide. Remember when the PHP critical update took websites down in hours, for updates? That may be helpful here.
Justin Đoàn8Somehow I haven't been paying and didn't realise Humble Bundle had gone to shit, until the other day when I saw they were selling some AI prompting course??
Steve Lee3Trying to delete my account now, but can't even find a way to do - can you see one?
BenRad2I said "tha fuck?" Out loud earlier today when I went to change mine.
Busted Atlas | Proto Trigger2Logged in (successfully) and was greeted with a 404 page. I am still logged in. 🫠
KolmoPDF1Skipping the current-password check also usually means they skipped revoking active session tokens on rotation. If an attacker grabs a session cookie once, changing the password leaves their existing bearer token valid indefinitely.
Looks like this might be the one that gets us lads. Humble Bundle has replaced their website with AI slop that doesn't work, and as well as removing 2FA, they've removed *the ability to remove your saved bank details or delete your account*
Grudging Signup18As a test I put something in my cart and went to the checkout and it wanted new payment details so it rather looks like they've lost the payment details as well as the 2FA which is a kind of security I guess? 😒
YOᗰᗩ4Isn’t this illegal considering they operate in the EU as well?
Jamie Roberts4Been checking my saved passwords and emails to see if I signed up. Got a receipt, but no record of an account. Worried that if I log in via google, it'll just create an account... I hate the internet
Neil3TOTP-based 2FA? Top of the Pops based 2FA? Can you be seen in TOTP reruns, or have you been scrubbed? That TOTP-based one factor authentication.
Matt Farrow3What the hell was whoever did this thinking? What was the intended purpose of this?
Mirrored Knight "Prinny"1WHAT DO YOU MEAN YOU CAN'T CLOSE YOUR ACCOUNT??
Mathias Wolfbrok9It's time to flood their inbox with GDPR complaints
Lapys Aoneeris (fae/she 🏳️⚧️)5Well, I knew it would happen with how much they were pushing for AI bundles. Can’t say I’m surprised. But fuck, I’m angry.
Megadude2Now, why would they decide to remove your ability to back out AFTER forcing Vibe-Coding and removing important safety features? It's almost as if they WANT your account to get hacked and your data sold.
Reminder: My Bundle of Holding site is unrelated to and not associated with Humble Bundle. The Bundle of Holding site doesn't store credit-card information and never has.
Humble Bundle Updated their website and it broke severely from the genAI coding. They have been pro-gen AI for months with promoting and discussing chatgpt / generative AI bundles and collaborations. On their blogs and previous bundle deals. -y kotaku.com/humble-bundl...
Safe Muffins4I downloaded all of the stuff I bought, put it on my NAS when HB was sold to IGN. I changed the password to something redonkulous, and essentially abandoned the account. The original premise of HB died long ago when the focus shifted away from charity. I've never looked back.
Trevor Bramble4It is infuriating to be, and be surrounded by, out of work software engineers only to see companies make everything worse with this shit.
GaymerLocutus2Humble Bundle se rediseño con una nueva apariencia y por el camino han desaparecido todos los sistemas de verificación y seguridad de las cuentas Ha desaparecido la verificación en 2 pasos, cambiar la contraseña sin confirmar antes la vieja o cambiar de email sin informar a la cuenta original
Good lord, the new Humble Bundle website is fucking abysmal to use. I usually don't say much about UI changes since I understand that getting used to a change takes some time and often I can consider how there are subtle improvements, but WOW this vibecoded trash should not have been rolled out.
ompuco21Going through my HB Choice catalogue is miserable. You can only see it via the library view now next to purchases, with one entry for each title instead of each month, there are no longer any previews available for titles from previous choice bundles, and you can now only see 5 entries at a time.
Taw - Play Tailraise!3It's very disappointing to see but I've had low expectations of Humble Bundle ever since they got bought out. There's a lot of issues and unsafe practices throughout the site and none of this should have ever gone live in this state.
Seems you have to request it via support ticket. Assuming they actually follow through and do what is requested. Choose Humble Bundle Account > Delete Account support.humblebundle.com/hc/en-us/req...
Zamandius56You can, and they won't even really check if it's actually you doing it. At least that's what happened to me.
Skops5Just to update on this since it might save people time. They wanted me to go to this site and request data removal there: dsar.humblebundle.com
Project Orion stan account4that's still a violation afaik (cancelation should be equal effort to creation), but hey, better than nothing lol
“Humble Bundle just completely killed most of their security through vibecoding | SpaceBattles” https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/
Pookleblinky115"To start with, 2-factor authentication no longer exists, it does not ask for any tokens to log in, so your password is the only security on there. You can also change your password without confirmation - you don't need to either enter the previous password *or* double-enter the new password."
nagi2If you have paypal linked, unlink it **NOW**
