Humble Bundle redesign removes two-factor authentication options from account settings

Redesign drops 2FA management

The Humble Bundle storefront, which sells games and other software, recently rolled out a refreshed design — and somewhere along the way, its account settings lost the controls for two-factor verification. According to The Verge, the new settings page gives users no way to enrol a new second factor or update an existing one. Kotaku first reported the omission.

The gap looks more like an oversight than a deliberate decision that was announced to customers. As PC Gamer observed, Humble Bundle still maintains support pages explaining how two-factor verification is supposed to work, and one of its writers had successfully configured the feature on the previous version of the site. The documentation now describes options that the live interface no longer exposes.

What still works, and what does not

Some verification machinery appears to remain in place, though the picture is inconsistent. When The Verge reporter Jay Peters logged into his own account while working on the story, the site sent an access code to his email address and required it before granting entry.

Two other details from that same test are harder to explain away. Peters found he could change his account password while signed in without first entering his current one. And although his password manager showed he had at some point registered a rotating, app-generated two-factor code for Humble Bundle, the site never asked him to supply that code at any stage of the login flow — which suggests an enrolled second factor may simply not be enforced anymore.

The Verge notes that IGN Entertainment, which owns Humble Bundle, and Ziff Davis, IGN's parent company, had not responded to a request for comment prior to publication.

Why it matters

Two-factor authentication is one of the most basic defences against account takeover, and the failure mode here is twofold. New users cannot add a second factor at all, while existing users cannot audit, rotate or remove one — and may not realise that a factor they enrolled years ago is no longer being checked. Peters' own experience is a concrete example: a rotating code existed on file for his account, yet nothing in the login process asked for it.

The password behaviour compounds the risk. Allowing a password change without confirming the current password means that anyone who hijacks an active session, for example through a stolen cookie or an unattended shared machine, could lock the rightful owner out of the account entirely, with no additional challenge standing in the way.

Redesigns frequently ship with feature gaps, and security settings are a common casualty because they are rarely exercised during visual overhauls. Until Humble Bundle restores the controls or explains its plans, users who want genuine two-factor protection on the storefront have no self-service way to obtain it, and those who believed they already had it may want to verify that their login flow actually demands a second factor. For a commerce site, that is an uncomfortable position, and the absence of any comment from IGN or Ziff Davis so far leaves the timeline for a fix unclear.