Humble Bundle’s New Redesign Removes Two-Factor Authentication, Leaving Accounts Exposed
Humble Bundle has relaunched its storefront with a brand new website design, and in the process the pay-what-you-want platform appears to have quietly dropped two-factor authentication entirely, a basic account security feature that protects against stolen passwords. Players who rely on the site to store payment details for game, book and software bundles are now being told to strip that information from their accounts until the issue is addressed.
No Way To Turn It Back On
On the previous version of the site, users could enable TOTP-based two-factor authentication to add a second login step beyond their email and password. The new redesign offers no setting to add that protection, and accounts that already had it switched on are reportedly able to log back in with just an email and password, with no prompt for an authentication code anywhere in the process. Humble Bundle’s own support pages still list articles encouraging customers to turn on two-factor authentication, an option that is currently impossible to use.
The change has not been explained or announced by Humble Bundle anywhere on the new site, and reports of the missing feature began circulating across several gaming and tech communities within the last day, including threads on the Humble Bundle subreddit and in broader forums like r/pcgaming, r/pcmasterrace and r/Games. Many posts point out that Humble Bundle accounts can have credit card details saved to them, which is exactly the kind of information two-factor authentication is meant to protect if a password is ever compromised.
“I can’t even see a way to remove saved payment details anymore.”
A user on the Humble Bundle subreddit
Humble Bundle sells pay-what-you-want game, book and software bundles, with a portion of proceeds typically going to charity.
Payment Details And Support Tickets Also Affected
Two-factor authentication is not the only part of the redesign drawing complaints. Some users say they can no longer find a way to remove saved payment methods from their accounts at all, and separate reports describe the site’s support ticket system breaking at the same time, making it harder to reach Humble Bundle directly about refunds or other account issues while the security gap remains open. As of this writing, Humble Bundle has not issued a public statement addressing whether the removal of two-factor authentication was intentional or confirming when it might be restored.
What To Do In The Meantime
Humble Bundle has been owned by IGN Entertainment since 2017, having built its reputation on charity-driven bundle sales for PC games before expanding into books, comics and software. Until the company restores two-factor authentication or clarifies the situation, security-minded users are being advised to remove any saved card details from their Humble Bundle account and to keep a close eye on related statements or billing activity in the meantime.
Keep the adventure going! Check out more Gaming News on Gamersuniverse.
Picture Source: Humble Bundle
