Humble Bundle Redesign Reportedly Removes 2FA and Raises Security Concerns

Humble Bundle’s redesigned website appears to have removed two-factor authentication controls and several other account-security safeguards, according to testing reported by Kotaku.

The publication found that the option to enable or manage two-factor authentication was missing from its account security settings after the redesign. Kotaku also reported fewer authentication checks when changing important account information.

Kotaku’s testing raises account security concerns

According to the report, a user who was already logged in could enter a new password without first providing the account’s existing password. When Kotaku tested changing the email address attached to the account, verification was not sent to the old address.

Instead, information related to that change was sent to the newly entered email address. The reported behavior has raised concerns about what an unauthorized person could do if they had already gained access to a Humble account.

The report does not establish that Humble Bundle has suffered a data breach or that customer accounts have been compromised. The concern is about the apparent removal of protections that can help limit damage after login credentials are exposed or an active session is accessed.

Kotaku contacted Humble Bundle for comment. Humble Bundle is owned by IGN.

The redesign also changed library management

Security is not the only area drawing criticism. Users have reported purchasing errors following the redesign, while other complaints focus on changes to the way game keys are organized.

The distinction between redeemed and unredeemed keys has reportedly been removed or made harder to see. That can make it more difficult for people with large Humble libraries to identify purchases they have not yet claimed.

Kotaku also reported that users can no longer remain logged in between sessions in the same way as before. Together, the account changes and library-management complaints have made the redesign a source of frustration for customers who rely on Humble both as a storefront and as a long-term archive of purchased keys.

Some online users have speculated about how the new site was built, but there is no confirmed basis in the approved reporting for attributing the redesign to a particular AI tool or development process. The documented issue is the behavior Kotaku observed during its account testing.

Which missing Humble Bundle account feature would you most want restored first?