Humble Bundle Drops Two-Factor Authentication in Redesign

Humble Bundle's recent redesign quietly removed the option for users to add or update their two-factor authentication settings.

Game and software storefront Humble Bundle recently launched a visual redesign, but the new look came with a surprising omission. According to reporting from Kotaku and PC Gamer, the updated account settings page no longer provides a way for users to add, update, or otherwise manage their two-factor authentication (2FA) methods. This change appears to have been made without any public announcement, leaving users to discover the missing functionality on their own. The situation is made more confusing by the fact that Humble Bundle's own support pages still contain articles that discuss and explain how to set up 2FA, creating a disconnect between the company's documentation and its current product offering. This quiet removal of a standard security feature represents a significant step backward for account protection on the popular platform.

Two-factor authentication is a foundational security practice that adds a critical second layer of defense beyond a simple password. It typically requires a user to provide a time-sensitive code from an app or a physical device to prove their identity when logging in. By removing the user interface for managing 2FA, Humble Bundle has created a security regression. While it is unclear if existing 2FA setups continue to function, the inability to modify them presents a serious problem. Users who lose their phone, switch authenticator apps, or simply want to enable this protection for the first time are now unable to do so. This effectively locks users out of managing their own account security and leaves them more vulnerable to account takeover attacks, where a compromised password is all an attacker needs to gain full access.

The incident serves as a cautionary tale for product and engineering teams about the hidden risks of major redesigns. In the push to modernize a user interface and streamline user experience, it is common for teams to focus heavily on front-end aesthetics and primary user journeys. However, less-visible but critical backend functions, particularly security settings, can be overlooked or deprioritized to meet launch deadlines. This decision goes against established industry best practices, where the trend is to strengthen security measures, not weaken them. For a platform like Humble Bundle, which is heavily used by a tech-savvy audience of developers and gamers who expect robust security, such a regression is particularly jarring and risks eroding user trust.

For CTOs, security leads, and product managers, the key takeaway is the absolute necessity of including comprehensive feature audits as part of any migration or redesign process. A checklist for feature parity must explicitly include all security-related functionalities, from password resets to multi-factor authentication management. Security and engineering teams should be involved early in the design and planning stages, not just as a final sign-off before launch. The next step is to watch how Humble Bundle responds to the public reporting. A swift restoration of the feature would signal that this was an unintentional oversight, while a delayed or non-existent response could indicate a more concerning strategic decision. This case study highlights the importance of treating security features as non-negotiable components of the core product experience.

This move is a significant security regression on a platform many developers use to purchase software. It serves as a stark reminder for engineering and security teams that redesigns can inadvertently remove critical features, creating new vulnerabilities for users and the company.

Removing a standard security feature like 2FA erodes user trust and increases the risk of account takeovers, which can lead to fraud and reputational damage. For product leaders, this highlights the critical need for security reviews during any UI/UX refresh.