Humble Bundle 通过 vivicoding 彻底消除了大部分安全性
原文：Humble Bundle just completely killed most of their security through vibecoding
英文正文：点「译成中文」可整篇机器翻译（免费通道，不花钱），翻好永久缓存、下次秒开。
评论
-
If you're here because Ao3 is down, welcome to SpaceBattles! You can Discover Stories (or Quests if you like interactive fiction) in a familiar story archive format, or browse the same content in the style of a traditional forum with our Creative Writing and Quests sections. Our weekly trending leaderboards are a good way to check out what's hot right now.
You can keep track of your favorite stories and join the conversation by registering an account . Please take a look at our rules before you post, and enjoy our humble community!
You should upgrade or use an alternative browser .
Humble Bundle just completely killed most of their security through vibecoding
- Thread starter Winchester
- Start date
Winchester
Buzzkill Humblebundle just rolled out their brand new website today, and they basically took their entire security setup out behind the shed and filled it full of lead.To start with, 2-factor authentication no longer exists, it does not ask for any tokens to log in, so your password is the only security on there.
You can also change your password without confirmation - you don't need to either enter the previous password *or* double-enter the new password.
On top of that, you can change your e-mail, without confirming using your password. If your account gets hijacked, you get an e-mail informing you that "your e-mail was changed, if this was not you contact support". And the "security provider" turns out to be an AI shop.
This is all stuff I've confirmed for myself after watching an IT security professional *lose his shit* live on stream over it. And someone in his chat is saying they've somehow managed to fuck up so bad that they have one-click payments enabled (which is illegal) for purchases.
Thankfully no payment details of mine appear to be stored on the site (I haven't used it in years before this and all my credit cards I could possibly have used here before are looong expired).
There's a reddit thread on it here that got posted six hours ago, but more stuff keeps being discovered and Humblebundle themselves have not had a word to say about it:
https://www.reddit.com/r/humblebundles/comments/1xtj3nj/2fa_removed_from_humble_bundle/
Master Basher
I AM MECHWARRIOR!Bruh?
EDIT: Seriously, why would they not even check their AI results for a common sense criteria on a security lens?
WriterAnt110
PSEC: Planetside SecurityAnother epic fail in terms of relying on AI to do things, seems like.
dhasenan
always lowercase Adviser (RP & Q)- Pronouns
- She/Her
The point of using LLMs is to get rid of as many workers as possible, especially the skilled ones, and produce code as fast as possible. But one of the things you get from a dev needing to spend time on a feature is evaluating business requirements, identifying if something needs pushback or modification. You don't get that from an LLM or an overworked junior dev with a codegen tool who's supposed to get the entire site rebuilt from scratch in two months.Bruh?
EDIT: Seriously, why would they not even check their AI results for a common sense criteria on a security lens? Click to expand... Click to shrink...
FaeGlade Plurality
- Pronouns
- Plural/They
So after seeing this, I naturally changed a bunch of things on my HumbleBundle account (password, unlinked payment info, unlinked steam account).
You do not get an email verification if you make any changes to your account, including security critical ones.
I confirmed this with friends who did the same, they also didn't get an email.
Absolute disaster, they should get their asses sued.
Alhazred23
Unreliable CommenterYou do get a verification code sent to your current new email address when you try to change the email address, but that is the only thing I noticed in terms of verification of anything when i was changing stuff. (Edit: corrected for the worse.)
Griever123
Thank you for the warning.Xon
StaffIt sends a "something has changed" on updating your email address at least.So after seeing this, I naturally changed a bunch of things on my HumbleBundle account (password, unlinked payment info, unlinked steam account).
You do not get an email verification if you make any changes to your account, including security critical ones.
I confirmed this with friends who did the same, they also didn't get an email.
Absolute disaster, they should get their asses sued. Click to expand... Click to shrink...
Useful right?An address changed on your account
An address (email or phone number) on your account was recently changed. If you made this change, no further action is required.
If you did not make this change, please contact support immediately. Click to expand... Click to shrink...
The verification code goes to the new email address!You do get a verification code sent to your current email address when you try to change the email address, but that is the only thing I noticed in terms of verification of anything when i was changing stuff.
Click to expand... Click to shrink...
It might have send a email 2fa to you on login, but that appears to be a crapshot on if it triggers Last edited:
Alhazred23
Unreliable CommenterThe verification code goes to the new email address!
It might have send a email 2fa to you on login, but that appears to be a crapshot on if it triggers Click to expand... Click to shrink...
<looks at phone again> i stand corrected. This starting to look less like a vibe-coding fuck-up and more like intentional enablement of account theft.
Isil`Zha
Beyond the Bounds Staff
I'd recommend deleting your account from that vibe coded minefield of gaping security holes.
Cornuthaum
Be kind to each other."hey can I break into your house and steal your valuables?" "yeah sure, the spare keys are in the mailbox"The verification code goes to the new email address! Click to expand... Click to shrink...
Alhazred23
Unreliable CommenterIncidentally, the place to do that is here: https://support.humblebundle.com/hc/en-us/requests/new
I'd recommend deleting your account from that vibe coded minefield of gaping security holes. Click to expand... Click to shrink...
Looks like the earliest the system will even open the email to laugh at you is 1 week. Last edited:
Maugan Ra
Yeah I just logged in and can confirm I was able to change a bunch of my own information without hitting any obstacle or getting any notification sent to my email or anything.
I've unlinked my steam and changed the password and as far as I can tell I don't have any payment info on there anyway, but shit is dire.
Andrensath
- Pronouns
- She/Her
I just tested and the "your email address has been changed" message (sent to your pre-change address, after verifying the change) doesn't actually have a link to contact Humble support. It does have a link to some hopefully-but-probably-not-unrelated AI "security" company.
BBBence1111
Harbinger of Bad LuckOn the bright side, they do have bot protections. The captcha showed up 3 times when I checked my login. Once on username, once then twice on password.
Oh god the library is such a mess. I tried to check what I even have on there and everything is duplicated 5 times.
ultima333
Always Remember Happy DayVerified the status - no 2FA, no password change email, no basic "enter your current password/enter your new password" during change- just "yeah put the new one in, just once, okay done hope you didn't have a typo lol"
I have never seen a site decide to kneecap their own basic user security this much.
Oh, and another thing, going to my Library > Bundles page doesn't list any bundles prior to 2018
It appears they're still in my library (going to Sort By Date > last few pages) at least.
(Also- the Library only shows 5 items at a time, and has no option to change that. And without the option to hide unredeemed, my library is now over 1100 pages long. Unusable.)
folti
There is no Cabalbecause when management gets AI psychosis, they'll fire the people who are the ones with the most vocal criticism first, and then as the vibecoding gets worse in the company, the remaining devs gets swamped with reviewing the garbage, and either leave on their own accord, or just stop giving a shit due to burnout, and let all the digital nuclear waste into the codebase. And that's where they still have some nominal human oversight, and not went full agentic, so if the review agent decides a change is good, it'll get merged into master even if it's actual garbage, but you'd need a human with knowledge about the system to understand that.Bruh?
EDIT: Seriously, why would they not even check their AI results for a common sense criteria on a security lens? Click to expand... Click to shrink...
Or just knows where you have to stop and think through some decision to avoid messing with the archiecture. Last edited:The point of using LLMs is to get rid of as many workers as possible, especially the skilled ones, and produce code as fast as possible. But one of the things you get from a dev needing to spend time on a feature is evaluating business requirements, identifying if something needs pushback or modification.
You don't get that from an LLM or an overworked junior dev with a codegen tool who's supposed to get the entire site rebuilt from scratch in two months.
Click to expand... Click to shrink...
There's a significant amount of my stuff missing from the "Library"…
oddhack
I just logged in and got a prompt and 6-digit code emailed to me.To start with, 2-factor authentication no longer exists, it does not ask for any tokens to log in, so your password is the only security on there.
Click to expand... Click to shrink...
Alhazred23
Unreliable CommenterThat was always there. It is single factor, since you can use the emailed code in place of entering your password.I just logged in and got a prompt and 6-digit code emailed to me.
Click to expand... Click to shrink...
Yeah, the factor in that case is ownership over the email-address attached to the account.
It's single factor and given the way email works, it's also not especially secure even for a single-factor system.
正文由本站服务器抓取保存（已自动过滤广告、推荐位与追踪图片），排版与原站可能不同；版权归原站所有。
