Deleted

While I've posited other alternatives as being more likely, there's still the chance that the gift links are being compromised due to a flaw in Humble's security. That security flaw is unlikely to be in the gift-link codes themselves [unless there's some sort of predictable pattern to their creation], but from the perspective of the users, the nuance of the difference isn't really relevant.

k

i guessed one and got clickteam fusion :3

time to farm!

View attached image.

Math - that's something YOU believe in.

View attached image.

So I've got a quick question about the above proof.
Why is the world gonna end in 1e17 seconds?
I done a quick bit of mental arithmatic based on my vague memory of school maths. This is a little over 3 billion years right?

Other than that seems good proof :)

Problem is they can tho ... i lost some shity game awhile back and im 102% sure my account wasnt compromised .

Had to spend 10$ to give a game that i got for 3.27 as part of 8 games bundle ...

SO yeah , they CAN be guessed :) dont understimate the russians

But...

View attached image.

Why do you take the logarithm of the number if you want to exponentiate it at the next line ? :)

An important remark that hasn't been made is that while we had a few reports on this forum of people where all gift links were hacked, we do not have a single report of people where only one git link was hacked.
This might convince math sceptics that people are actually NOT guessing the gift links. It would be almost impossible that only a few people would be impacted, and for all their links, if it were the case.

It indeed looks like a breach at HB, or at some individual users.

Since multiple people reported their gift links being compromised, without any indication that the account being compromised as well (unless I'm remembering wrong? I admit I haven't paid much attention to this), wouldn't it mean that either there is actually some pattern or some other kind of possible security link?

'1e9 times the remaining life of the universe per successful attempt'

But you're saying there's a chance? i better get started

Time to guess a link and snatch a copy of HL3 :D

answer from Humble Bundle support:
It appears that your keys were in fact compromised by a third party. I was able to reset/revoke the keys in question, while also revoking the keys that had been gifted away. This type of key theft does not happen often, but it does happen. We are currently in the process of making it more difficult for hackers and resellers to scrape URL for unused or unclaimed bundles or gift links.

Bottom line: don't create gift links if you don't need them straightaway. If you need to organize your keys in a spreadsheet or so, just but the bundle URL there instead. Yes, this will waste 8 seconds of your precious time every time you need a gift URL. Sorry.

There are more things in heaven and earth, Horatio,
Than are dreamt of in your philosophy.

Your formula is the chance of a successful guess for ONE link.

You need to multiply by the current number of active links generated by HIB in their databases. It will still be low, but not as low.

If your results of 1e9 times the remaining life of the universe is correct, if HiB database have one million active link, they will only need 1e3 times the remaining life of the universe to guess one active link.

Is there a reason for this thread?

The reason your logic fails with guessing is that someone would not have to try all of those to get one and only solution (like a password), but there's many solutions and if you're lucky you can guess some on random.

Obviously no one will guess them incrementally
https://en.wikipedia.org/wiki/Birthday_attack

Maybe the codes are generated something like

hash(current_time())

or

hash(random_int(0, 1000000000))

This would make it a lot easier to guess.

But what if I use 5 billion computers? :o

Also, I guess no one would attempt to brute force them, it's more likely they'd try to guess/deduce the Humble Bundle algorithm. Similar to how key generators work.

it'd be a lot easier to brute force username / password combinations

lol url's guess.. yeah right.. =)

my first thought would be a humble employee found themselves a side business by snagging a chunk of the gifting database occasionally, there's the most likely leak/issue imo..

I wish you did clock speeds for me.

hacks/breaches/insider leaks are more likely the cause to get your entire information/logins
stored on a mail stolen... even without being about as savvy as the next raw potato could be

• get breached 2012
• meme.jpg + wait-4.5-years.gif
• notify users 2016

/yahoo