It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
avatar
jsjrodman: Unrelated to my above post, in case this isn't clear, GOG.com is doing this because they sort of have to.

They've created a service that involves money changing hands, and the accounts are how ongoing ownership of purchased items are maintained. That means they have an obligation to keep that account ownership intact. It might not be a strict legal obligation (I am not a lawyer), but it's just a natural consequence of operating this kind of store where you need ongoing access to keep "ownership" of your items.
Then GOG should remove those shit features. Remove the shit wallet. Remove the shit regional pricing. Remove the shit Galaxy.

I own my shit here because I download and keep the installer for every game I own. No amount of shenanigans on GOG's part can remove that from me.

Stop renting your shit and you will be less troubled about hackers.
avatar
Lostinablock: On humble bundle this is mandatory. A few months ago I had lost one of my email domains and had to wait for a few days with humble support getting that changed.
On Humble I often have to wait up to an hor before I even get the f***ing code to login. I absolutely hate their two-step-authentication. I'm really glad it's optional here.
high rated
avatar
timppu: [...]

GOG probably just got swamped by requests to bring back hijacked accounts, something that probably always needs some work from GOG (e.g. how to make fully sure that the person asking an account to be diverted back to him is the real owner of the account, and not a hijacker).

[...]
Which wouldn't be the case if GOG asked for verification before letting the change go through, just like a ton of sties do for ages now, instead of just sending a confirmation email after the fact, telling you to contact support if they weren't made by you.



avatar
moonshineshadow: You get the email even if you have opted out.
Good to hear this. I guess that GOG made a special exception in my case when they never sent me the email about the latest changes to their User Agreement and Privacy Policy, and I had to get the link form a friend.
avatar
phaolo: So, is a confirmation now required also for changing email and password?
avatar
PaterAlf: Of course not. That would be easy to implement and in fact useful. GOG would never do such a thing. ;)
Sigh.. -_-
avatar
J_Darnley: Then GOG should remove those shit features. Remove the shit wallet. Remove the shit regional pricing. Remove the shit Galaxy.

I own my shit here because I download and keep the installer for every game I own. No amount of shenanigans on GOG's part can remove that from me.

Stop renting your shit and you will be less troubled about hackers.
are you nuts? what regional pricing or galaxy has to do with hackers who break into accounts to buy gifts codes using stolen card numbers to resell them later on g2a and similar places?

by your "logic" gog should block ability to buy gifts or better stop selling games at all to be safe.
high rated
avatar
Metahec: Is this a new thing with HB? I've had an account with them for at least four years and have never used 2FA. In my settings, it is deactivated an unlinked to my cellular.
I went ahead and added it to Authy and unlinked it without any problem.
Are you sure this isn't on-by-default, in the way GOG is moving, and you have to opt-out?
It is not 2FA, it is called "Humble Bundle Account Protection" and it uses cookies like this one. The only way to disable it is by using 2FA on humblebundle.

https://support.humblebundle.com/hc/en-us/articles/202434394-Humble-Account-Browser-Verification

Can Humble Bundle Account Protection be disabled?
Yes. While Humble Bundle Account Protection is enabled by default on all accounts, the feature can be disabled by turning on two-factor authentication. Once two-factor authentication has been successfully enabled, Humble Bundle Account Protection is automatically disabled on an account.
You'll probably down vote my posts for now on but it needs to be said. In this internet world we have now it is much better to block javascript, use an adblocker, and clear cookies/caches as much as possible when going out of the specific site you were in. In fact when I am forced to enable nasty third party javascripts/ disabling ublock origin like on mega.com I use another browser on an ram drive, the folders delete themselves after closing the browser. That browser profile has no bookmarks and is as generic as it could be. Our browsers, because they constantly evolve are a buggy mess and soon crackers will find ways to exploit html5.
Most people will do nasty things to others when they can benefit and get away with it. Blaming people like you did with eiii for not bowing on corporations demands is doing ignorance. Not following the "crowd" mentality is the way to go.
avatar
Lostinablock: Most people will do nasty things to others when they can benefit and get away with it.
Oh, they don't even need to benefit.
avatar
Darvond: It would also be appreciated if rather than having to rely on GOG's system, I'd prefer to use Google's Authentication. I already use it for Discord and Google, so it'd come in quite handy.
avatar
plagren: I, on the other hand, appreciate it when a website doesn't rely on a massive data mining company for everything. Some things are more important than convenience.
You do realize that Google provides options to greatly reduce said mining?
high rated
avatar
plagren: I, on the other hand, appreciate it when a website doesn't rely on a massive data mining company for everything. Some things are more important than convenience.
avatar
Darvond: You do realize that Google provides options to greatly reduce said mining?
Which, I'll hazard a guess at, you need to make an account & keep logged in with to do so?
Sort of defeats the point ;)
avatar
moonshineshadow: You get the email even if you have opted out.
avatar
HypersomniacLive: Good to hear this. I guess that GOG made a special exception in my case when they never sent me the email about the latest changes to their User Agreement and Privacy Policy, and I had to get the link form a friend.
Great. That means even their email sending is bugged. Why am I not surprised ;-)
avatar
Darvond: You do realize that Google provides options to greatly reduce said mining?
avatar
fishbaits: Which, I'll hazard a guess at, you need to make an account & keep logged in with to do so?
Sort of defeats the point ;)
If by defeats the point, you mean you're allowed to clear and freeze web history, then sure.
avatar
snowkatt: common sense is quite uncommon nowadays
I also find that it's not as sensual these days.
I understand why they may want to to do this, but I wonder how that is going to affect theif flash sales, when they only have an allotted amount of titles for a specified price. I thought GOG did that a few times.

Al least GOG is giving us an option to opt out if we wish, which is very much appreciated.
avatar
Stryder2931: I understand why they may want to to do this, but I wonder how that is going to affect theif flash sales, when they only have an allotted amount of titles for a specified price. I thought GOG did that a few times.

Al least GOG is giving us an option to opt out if we wish, which is very much appreciated.
People tend to stay logged on during such sales, and that's definitely the advice always. Plus, if the system works well and especially since we're talking about an e-mail 2fa, not a phone one, it shouldn't really matter in most cases, bar for those games gone in seconds. And for those even logging on normally may be an issue, hence the strong advice to stay logged on if interested in those sales.
And, like you said, those who don't like it can just turn it off.
avatar
HypersomniacLive: <snip>
GOG will enable two-step login on all existing accounts on Oct 24, 2016. The email contains a link to opt-out before said date. There's also the option to disable it via the usual account settings after Oct 24.
<snip>
Thanks for the heads-up. I don't check my email every day (or even every other day <g>), so haven''t yet seen this.

I followed the "opt out" link you posted, and got "opted-out".

However, if it's based on local cookies, then it's probably not going to work for me, because I browse where all my cookies get deleted on browser exit. I won't compromise that choice by having it "remember" to save GOG cookies.

So.. if it's cookie-based, that means that I won't be effectively opted-out. Thusly, logging-in is going to be a hassle. That will end up meaning less engagement with the site on my part. Which will mean fewer forum posts (big whoop) and (more important to them), fewer buys from me. My library says I have nearly 700 games, so I have plenty to play without having to buy more.

I guess we'll see how this gets implemented..