News for hackers. Stuff that matters.
Re:Humble Bundle just killed most of their security through ... by nyktas on Thursday November 12, 2026 @03:50AM (#50464656)
After they repeatedly reinstated, without consent, recurring payment for their subscription plan Humble Choice, which I repeatedly chose to pause (yes, they offered it as a first-party option), I had to cancel the plan entirely, as an early subscriber back when it's called Monthly.

It showed me that they just don't care anymore.

But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.

Re:Humble Bundle just killed most of their security through ... by anilakar on Thursday November 12, 2026 @03:52AM (#50464670)
You're very familiar with the dark pattern in the cancel flow.

You have to click through multiple primary cancel buttons, but the final one cancels the cancellation.

Re:Humble Bundle just killed most of their security through ... by nyktas on Thursday November 12, 2026 @04:01AM (#50464747)
To be "fair" (if a victim "failing" to recognize a dark pattern should be counted on the victim), I wasn't exactly familiar with dark patterns, back when I cancelled the plan.

Interestingly, they didn't seem to set up much dark pattern for the cancellation of it - I recorded the automatically reinstated payment in a private rant post, but not a dark pattern in cancellation. To this point I don't really care to conspiracy this into the theory that they knew users who were angry enough to cancel couldn't be stopped, and/or the law might be against a dark cancellation pattern, but no so much as to a pause.

Re:Humble Bundle just killed most of their security through ... by p2detar on Thursday November 12, 2026 @03:59AM (#50464731)
[delayed]
Re:Humble Bundle just killed most of their security through ... by nyktas on Thursday November 12, 2026 @07:08AM (#50466011)
You are right, so to be precise: that was a hypothesis. It could well be a cheaper human dev doing something they don't understand.
Re:Humble Bundle just killed most of their security through ... by Keeeeeeeks on Thursday November 12, 2026 @07:12AM (#50466056)
- The UI components are the ones that cheap AIs default to - multiple regressions in functionality (can’t delete a card easily, no 2FA check, a lot of purchases are missing because somehow they botched a migration?) - they had a consistent design system for the FE before this, and now it looks like “Generic Gaming Website From 2025-2026. [Phrase 1. Phrase 2. Phrase 3]”

Even if they outsourced to devs that used AI, they are asking for a lawsuit to remove core security safeguards, while rolling old subscription plans onto the new plan in the same rewrite/migration.

Re:Humble Bundle just killed most of their security through ... by looperhacks on Thursday November 12, 2026 @04:09AM (#50464803)
Maybe it was different when you used it, but when I had Humble Choice years ago, I remember that it was very clearly communicated that the "pause" is for one month only. Maybe a dark pattern that you have to remember, but it was shown
Re:Humble Bundle just killed most of their security through ... by Ekaros on Thursday November 12, 2026 @04:28AM (#50464960)
To me it was always pretty clear. Though I have heard there was some probable weirdness in the functionality. Still bit questionable of grandfathered "classic" subscribers were forced to go through this to keep their status. But that is pretty normal, only have seen one site that allows coming back later to subs at old sub.

With them killing the "classic" it doesn't really matter anymore. Better just to cancel.

Re:Humble Bundle just killed most of their security through ... by nyktas on Thursday November 12, 2026 @07:09AM (#50466020)
Could be muddy memories, but yeah, leaving a Classic subscriber to that is a shame.