Humble Bundle's new website has reportedly eliminated 2-factor authentication (2FA), leaving user accounts protected only by passwords. This shift occurred alongside the removal of standard security protocols, such as requiring a previous password or double-entry to update account credentials.
Removal of Multi-Step Verifications
The updated Humble Bundle site allows users to change their passwords without confirming the old password or double-entering the new one. Furthermore, the system permits email address changes without requiring a verification code to be sent to the current email on file.
While some users reported receiving a 'something has changed' notification, these alerts do not always include a direct link to contact support. In some instances, the notification directs users to an external AI-based security provider rather than Humble Bundle's internal support team.
“Humblebundle just rolled out their brand new website today, and they basically took their entire security setup out behind the shed and filled it full of lead.”
— Humble Bundle just completely killed most of their security through vibecoding
The Role of AI-Assisted Development
The security regressions are attributed to 'vibecoding,' a development style that leverages Large Language Models (LLMs) to generate code rapidly. This approach can prioritize the speed of rebuilding a site from scratch over the nuanced evaluation of business requirements and security risks.
Critics of this method argue that while AI can produce functional code quickly, it lacks the 'common sense' criteria required to identify security vulnerabilities. This can result in a 'shotgun' project where the software is functionally complete but structurally insecure.
User Impact and Risks
The lack of 2FA and verification steps significantly lowers the barrier for account hijacking. If a password is compromised, an attacker can immediately seize control of the account by changing the associated email and password without triggering any secondary hurdles.
Additionally, reports suggest the new site may have enabled one-click payments. This functionality, combined with the lack of account protections, creates a high-risk environment for users with stored payment methods or linked gaming accounts.
What Hacker News readers are saying
- Experience: One commenter who experienced the new system reported that it was functionally worse for users, noting that they received an email verification code an hour late. comment ↗
- Skeptical: Several commenters expressed concern that the removal of two-factor authentication leaves accounts vulnerable, with one user questioning why there were fewer complaints about the downgrade. comment ↗
- Skeptical: One commenter argued that the issue lies with human management rather than the technology, suggesting that software is poor because of people who do not know how to build it end-to-end. comment ↗
Summarized opinions from the Hacker News thread, not verified facts. Read the full discussion ↗