RSN | WireMan - also on bsky

Humble Bundle just shit the bed on the security side. You no longer have 2FA in your login flow and 2FA doesn't appear anywhere in your settings. It's been completely removed from the website. That means your password is the only thing protecting your account now. You should always operate under the assumption that your password is compromised. That's why 2FA is so important. Once you're logged in you can just change your password without having the original password for verification. It just immediately changes the account password to whatever you want. This means if your session is hijacked the attacker can fully own your account. Changing your email works the same way. It asks for a verification code on the NEW email not the old one. This lets the attacker swap your email out without a single barrier. It doesn't even send an alert to the original email until after the account is tied to the new email. This is some vibe-coded garbage. Change your passwords immediately at the very least.