Humble Bundle's Redesign Weakens Account Security by Removing 2FA

The recent overhaul of Humble Bundle, a well-known digital storefront offering games, books, and software in pay-what-you-want bundles, has sparked considerable concern among its user base. The newly launched website inexplicably lacks support for two-factor authentication (2FA), a critical security feature. This deficiency not only prevents users from activating 2FA on their accounts but also renders previously enabled 2FA ineffective, allowing logins with just an email and password.

Humble Bundle's Security Downgrade Sparks Outcry Among Users

The controversy began with the launch of the updated Humble Bundle website. Users quickly noticed the absence of two-factor authentication, a security measure that adds an extra layer of protection beyond a password. Previously, Humble Bundle actively promoted and supported 2FA, with its FAQ section still containing articles encouraging its use for account security. However, these guidelines are now in direct conflict with the functionality of the new site, where 2FA options are entirely missing, and existing 2FA protections are bypassed during the login process. The lack of official communication from Humble Bundle regarding this significant security change has only amplified user frustration. The author of this report has reached out to Humble Bundle for clarification on whether this removal was intentional and if there are plans for its reinstatement.

This development is highly problematic for several reasons. Two-factor authentication is crucial for safeguarding user accounts, especially those linked to sensitive financial data such as credit card information. Even if an attacker gains access to a user's password, 2FA prevents unauthorized access by requiring a second verification step, typically a time-sensitive code. In an era where password hygiene is often suboptimal, 2FA serves as a vital defense mechanism against cyber threats. The user community has reacted with strong disapproval across various platforms, including the Humble Bundle subreddit, where users have labeled the change as "insanely bad" and expressed difficulty in even removing saved payment details, citing significant security risks. There is a general consensus that the site should address these vulnerabilities immediately. It is highly improbable that such a critical security rollback was intentional. Until these issues are resolved, users are advised to consider removing any saved payment information from their accounts, although some have reported difficulties in doing so.