Humble Bundle's Redesign Drops Two-Factor Controls and Leaves Password Changes Unguarded
Humble Bundle's redesigned settings page no longer offers a way to add or update two-factor verification methods, according to The Verge. The storefront, which sells games and other software, recently received the redesign, and the change applies to the account security controls on the settings page.
The Verge's reporting also describes how the login and password flows behaved at the time. Signing in prompted the user to check email for an access code before the account could be opened. A logged-in user could change the password without entering the existing one. The reporter had previously set up a rotating two-factor code on the account, but was not asked to enter it during login on the day of reporting, according to the same account.
Humble Bundle is owned by IGN Entertainment, which in turn is a subsidiary of Ziff Davis, the parent company of IGN. The redesign therefore sits within a larger media group's consumer properties.
In my view, the combination of those three behaviors deserves more attention than the removal of a single menu item. An email one-time code is only as safe as the inbox that receives it, so an account whose recovery and verification depend on one mailbox has a single point of failure. A password change that does not require the current password means a session with valid credentials can alter the authentication secret without a second confirmation. Taken together, a user who already has a session, or whose email account is compromised, would face fewer barriers than the login prompt alone suggests. That is a reasoned reading of the design, not a finding about any actual intrusion.
The broader context here is the gap between what a storefront holds and how it authenticates its users. A Humble Bundle account can carry a library of purchased titles, and for many users that library is the main asset tied to the login. Authenticator-app TOTP (time-based one-time passwords, the rotating six-digit codes generated by an app), hardware security keys and passkeys are widely deployed across the industry, and the expectation that a platform with stored payment methods and purchase histories offers them is reasonable. Email codes remain a workable option for many people, particularly those who cannot use an app, so they are not the problem in themselves. The question for Humble Bundle, and for any platform going through a redesign, is whether users keep the choice of stronger methods and whether re-authentication is required for sensitive changes.
The practical outcome is simple to state. A settings redesign is the moment a service decides which security controls remain visible and which require a second step. Restoring the ability to manage verification methods, and asking for the current password before a change, would close the specific gaps the reporting describes. Users who want to check their own accounts can review their security settings now, confirm which second factors are still enrolled, and make sure the email address tied to the account is protected with its own strong second factor.
