Humble Bundle quietly dropped 2FA and broke its own login
Humble Bundle just killed most of their security through vibecoding
Hacker News readers tore into Humble Bundle's rebuilt storefront after users found two-factor authentication simply gone, logins that only work if a code arrives an hour late, three captchas per sign-in, and one-click payments enabled without consent. The thread blames a rushed "vibecoding" rewrite shipped without basic testing, though some argue insecure software predates AI and the real failure sits with management that never checks the result.
The issue is the vibe coding.
- oliwarner
Weird that they lay all this at the feet of vibecoding. I've asked for authentication systems several times and they've tended to come with pretty good feature-sets. Perhaps it's because I know what I'm asking for.
Edit: I've just tried to log in and it's failed through both Google and email. Whatever they've done, they haven't tested it well.
- trvz
This is not AI's fault. In fact, they had to probably fight the LLM to get it this simple.
I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
- Ekaros
Perfect example of when rewrite is functionally worse for users and done for sake of doing it...
I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
- dtech
> You can also change your password without confirmation - you don't need to either enter the previous password or double-enter the new password.
This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.
- 1313ed01
Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
- aeQu5igh
They deleted the download link for the original humble bundle. I can no longer download Gish.
- agilob
> so bad that they have one-click payments enabled (which is illegal) for purchases.
Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
- scaglio
For anyone interested in deleting their account, I think this is the right link (at the bottom of the homepage): https://dsar.humblebundle.com/