Best of Boomer Shooters Bundle (Image credit: Humble Bundle)

Follow us

Add us as a preferred source on Google

Users of Humble Bundle—the pay-what-you-want game-bundle storefront that will also sell you books and software—have been alarmed by a new redesign that seems to have axed a foundational piece of login security tech.

The just-released new Humble Bundle website has no support for two-factor authentication whatsoever: users are unable to add it to their accounts, while those who had previously set it up on the old site design (including yours truly) are able to log in with just an email and password. At no point in the login process does the site ask you to input a 2FA code.

Humble Bundle does not address the removal of 2FA anywhere on its new site. In fact, the site's FAQs still feature articles encouraging users to make use of it to keep their accounts secure, which is currently impossible. I have reached out to Humble Bundle to ask if the change was intentional and if it will be reversed, and will update this piece if I hear back.

This is, to put it mildly, concerning. The point of two-factor (or multi-factor) authentication is to make user accounts—which, on Humble Bundle, may well have credit card info saved to them—more secure. Even in the event your account password became compromised, your attacker would be unable to get into your account without also having access to your 2FA codes, which are constantly regenerated and only valid for short periods of time. In a world where too many people have bad password hygiene, it's a vital bit of security tech.

Unsurprisingly, Humble Bundle users are aghast at the uncommunicated weakening of their account security. "This is insanely bad, they need to take down password changes entirely until this is fixed", wrote one user in the Humble Bundle subreddit. "I can't even see a way to remove saved payment details anymore, this is seriously dangerous and the site should be taken offline until fixed ASAP", wrote another. They all, uh, they all pretty much go like that. No one is happy about this.

I have to imagine this was not an intentional change. Indeed, I can't fathom the circumstances under which it would be intentional. Either way, while 2FA's absence endures, you might want to play it safe and remove any saved payment details you have tied to your account, though some users report having trouble doing that, too.

Keep up to date with the most important stories and the best deals, as picked by the PC Gamer team.

One of Josh's first memories is of playing Quake 2 on the family computer when he was much too young to be doing that, and he's been irreparably game-brained ever since. His writing has been featured in Vice, Fanbyte, and the Financial Times. He'll play pretty much anything, and has written far too much on everything from visual novels to Assassin's Creed. His most profound loves are for CRPGs, immersive sims, and any game whose ambition outstrips its budget. He thinks you're all far too mean about Deus Ex: Invisible War.