Humble Bundle's redesigned store drops two-factor login and loosens account changes
Users who relied on two-factor protection can no longer enable it, so their accounts now depend on a password alone until Humble responds.
Humble Bundle's newly launched storefront redesign appears to have dropped two-factor authentication entirely, with users unable to add or manage 2FA in their settings even though the help pages still recommend it. PC Gamer's writer, who had enabled 2FA on the old site, could log in with only an email and password, and the site never asks for a 2FA code during sign-in. Kotaku also reported that password and email changes no longer require the current password or verification sent to the old address, and that saved payment details are hard to remove, so users are advised to delete stored card information until the problems are fixed. The Verge found a partial safeguard in the form of an emailed access code at login, while noting its own rotating 2FA code was not requested, and Humble has not yet responded to requests for comment.
Why it matters
For anyone with a Humble Bundle account, the redesign has removed a layer of protection that many people use to guard against stolen passwords. Account holders can now sign in with only an email and password, and can change those credentials without proving they own the current ones. Because saved card details are also hard to remove, the practical risk extends to stored payment information. Humble has not yet commented, so the timing of any fix is unknown.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.