Users of Humble Bundle—the pay-what-you-want game-bundle storefront that will also sell you books and software—have been alarmed by a new redesign that seems to have axed a foundational piece of login security tech.
The just-released new Humble Bundle website has no support for two-factor authentication whatsoever: users are unable to add it to their accounts, while those who had previously set it up on the old site design (including yours truly) are able to log in with just an email and password. At no point in the login process does the site ask you to input a 2FA code.
Humble Bundle does not address the removal of 2FA anywhere on its new site. In fact, the site's FAQs still feature articles encouraging users to make use of it to keep their accounts secure, which is currently impossible. I have reached out to Humble Bundle to ask if the change was intentional and if it will be reversed, and will update this piece if I hear back.
This is, to put it mildly, concerning. The point of two-factor (or multi-factor) authentication is to make user accounts—which, on Humble Bundle, may well have credit card info saved to them—more secure. Even in the event your account password became compromised, your attacker would be unable to get into your account without also having access to your 2FA codes, which are constantly regenerated and only valid for short periods of time. In a world where too many people have bad password hygiene, it's a vital bit of security tech.
Unsurprisingly, Humble Bundle users are aghast at the uncommunicated weakening of their account security. "This is insanely bad, they need to take down password changes entirely until this is fixed", wrote one user in the Humble Bundle subreddit. "I can't even see a way to remove saved payment details anymore, this is seriously dangerous and the site should be taken offline until fixed ASAP", wrote another. They all, uh, they all pretty much go like that. No one is happy about this.
I have to imagine this was not an intentional change. Indeed, I can't fathom the circumstances under which it would be intentional. Either way, while 2FA's absence endures, you might want to play it safe and remove any saved payment details you have tied to your account, though some users report having trouble doing that, too.
