Humble Bundle Removes Two-Factor Authentication in Website Redesign

Humble Bundle, the digital game bundle storefront famous for its charity bundles, launched a new version of its website this month — but the redesign eliminated one of the most important security features: two-factor authentication (2FA). Users who had already enabled the feature were surprised to discover that, in the new system, it simply does not exist.

The change was initially spotted by users on the r/humblebundles subreddit on November 11, when game developer Jason Hall, known online as "Pirate Software", warned on social media that the 2FA option had disappeared from the login flow and "doesn't appear anywhere in your settings"[1]. The story spread rapidly across forums including ResetEra, SpaceBattles, and Hacker News.

What disappeared

Until the relaunch, Humble Bundle offered what it called "Two-Step Verification": after entering your password, the site requested a code from Google Authenticator[2]. Even accounts without that setup had "Humble Guard", an email code sent whenever login came from a new browser or device.

In the new interface, the "Security" section in account settings is a discreet heading at the bottom of the page, containing only one item: the field to update the password, with an "Update" button[3]. There is no mention of two-factor authentication, neither to enable nor disable it.

The new site's login system offers three entry options: traditional password, a one-time code sent by email, or Google authentication. The email code works as an alternative login method, not as a second factor — the password alone is sufficient to access the account. The "Update" button allows you to change the password; when you do, the site sends a confirmation code by email, but after that, the new password alone is enough to log in.

A revealing detail: the settings page's source code still carries the text of a "Two-Step Verification" section with options for "Google Authenticator" and "SMS (Authy)" — suggesting the functionality was planned for the new site and left out of the launch, rather than being intentionally removed.

Additional security problems

The impact goes beyond 2FA. Kotaku tested two additional vulnerabilities introduced by the redesign: anyone with an active session can change the account password without needing to enter the current one[4], and when changing the associated email, no verification is sent to the old address — the confirmation goes only to the new email. These two behaviors are standard security protocols that prevent someone who has gained access to a session from changing credentials.

Humble Bundle's own support page continues to recommend enabling 2FA in its account security guide[5], creating an absurd divergence between what the site teaches and what it actually offers.

Why this matters

Many Humble Bundle customers buy packages with one or two games and keep the remaining keys in their library for years. Those keys are exactly what an attacker would be looking for: a Steam, GOG, or Epic key works on whichever account redeems it first. Humble Bundle's own support rules acknowledge the severity — support can replace keys from purchases made in the last 14 days, but "we're unable to replace keys for older purchases," as stated on the FAQ page[6].

In addition to game keys, Humble Bundle accounts store payment information (saved cards and PayPal for checkout) and the Humble Choice subscription. All of this is exposed without the protection of a second authentication factor.

The attack vector is well-known and widely exploited: email and password credentials leaked from other services are routinely tested on major online stores. Two-factor authentication is exactly the barrier that prevents a reused password from working on another service. Without it, it only takes your having used the same password on a breached service for an attacker to gain access.

The technical system behind it

The new login system runs on auth.humblebundle.com and uses Ory, a third-party authentication service[3]. Ory Kratos documentation explicitly lists authenticator apps, security keys, and SMS or email codes as second authentication factors, treating 2FA as a feature the project owner enables in their project[7]. In other words: the underlying platform supports two-factor authentication. It simply isn't enabled in the Humble Bundle project.

Corporate context

Ziff Davis, the parent company of Humble Bundle (which has been owned by IGN since 2017), publicly mentioned the redesign during its third-quarter earnings call. CEO Vivek Shah stated that the old platform had elements that "interfered with conversions and customer experience"[8]. It is unclear whether the removal of 2FA was a conscious decision to prioritize conversion metrics over security, or if it is an implementation failure during the migration.

The company has not issued a public statement on the issue as of this publication. None of the major outlets that covered the story received a response from the company.

Until the problem is resolved, security experts' recommendation is clear: use a long, random password used exclusively for Humble Bundle; redeem all pending game keys to platforms like Steam, GOG, or Epic; remove saved credit cards; and ignore suspicious emails offering to "restore" 2FA — this type of change is exactly the material cybercriminals use for phishing.

The question to watch: in a scenario where security is sold as a priority in support guides, what else was sacrificed on the altar of customer experience?

Sources: Privacy Affairs, Heise Online, Kotaku

✓ Independent sources cross-checked and verified before publishing