Closed How Safe Is Your HumbleBundle?

Maybe they could add some sort of Password lock to the Preorder pages for each user?

 

Two pages were somehow found and posted over a russian chan. Those are the only ones still affected.

 

So.. DrChemistry, whats happen then?
You take your page again?

gl

 

They got me my Key back as for the page i think it's still showing up but the worst they could do is change the Email and the NPC name.

 

You are actually quite lucky you bought a badged tier. Since you can not change the forum account the badge is registered to we were able to let you know about this. Unfortunately for the pixel tier who's key was shared with yours they will not know their's was stolen (or the email was changed if they thought to claim the page) until the beta releases and they don't get an email about it. I almost shot the email listed a message but then saw it was Russian much like the site the key was posted on so...

Slightly off topic, the way these keys were found reminds me of the Google trick for finding webcam control pages.

 

So what now? I mean how do the starbound crew plan on taking these key pages down

 

I don't think they can do anything about pages that have already been indexed. But, they can do something to prevdnt google from indexing others in the future, which I believe Omni has already done. It actually only becomes a problem if you post the link somewhere public.

 

Yeah omni added a Robots.txt which will keep googlebot and other law abiding webcrawlers from being able to index anything within /redeem. So even if another key is leaked it should not end up on google aside from in the result for were it was posted.

 

I wish larry hadn't just make a thread about it if anything for chemistry's sake he should of just PM'd a mod or at the very least chucklefish support :/

 

I am actually pretty worried about this now, one of my bundles got claimed by someone other than me.

 

I'm pretty sure it was one of those people guessing keys and got lucky but then again there's probably someone out there who invented a key guesser program that randomizes the letters and numbers within a 5 digit by 3 game key (by that I mean XXXXX-XXXXX-XXXXX)

 

Yeah, that was pointed out, what is worse was after leaving out how I managed to track down the other key someone found it and posted it.

Make a humble account and claim the page, check your rewards page every so often, and make sure your email is safe, only the 2 managed to be figured out and posted.

As for the bundle, if it was not a gift and you bought it (again not as a gift) I would get in touch with humble support and see if they can remedy that for you (provide some proof that you purchased the bundle), though if it is an older bundle they might not be able to get you the steam-keys if they don't have any and the devs will not generate any more. But it is worth a shot.

 

My apologies, Im sure if someone wants to will figure it out, they will. I guess however, there is no harm in being cautious. I have removed the method from my post.


I thought by posting how to produce the problem, would help someone identify how to fix it. I clearly wasnt thinking like an evil person at the time.

 

I understand. It happens that sometimes when trying to do the right thing. You should always report stuff like that to staff rather then publicly posting it since someone could see it and have evil intent. No harm was really done since someone had already got access to it and claimed it already.

 

Thank god I only use humble bundle for Starbound.. I am still worried..

 

Actually the leak was the Starbound's rewards page not the humble downloads claim page for Starbound. I imagine humble has a robots.txt set to make sure if a key is posted googlebot will not index it. The leak was basically someone somehow got two rewards pages for starbound, then google index them and made them easily findable to more then just users of that chan that posted them.

 

We're working on a more permanent solution.

 

Starbound is on the humble bundle?!

 

It's handled through Humble's store (for payment and distribution). It's not part of a bundle though, no.

 

Russian 2chan? That thing is long gone! Must be the Chan!

Anyways, I myself am rather worried about the possible exploits of the bundle, but seeing as if what you can contact the support retarding his, plus haven't heard of bundle theft before...