THE CRUNCH
Humble Bundle's freshly redesigned storefront has quietly lost two-factor authentication. There is no way to add or update 2FA methods in the new settings, and users who previously set it up, including a PC Gamer writer, can log in with just an email and password without ever being asked for a code. Humble Bundle has not addressed the removal anywhere on the new site, whose support pages still encourage users to enable 2FA, which is currently impossible.
The picture is not entirely uniform. A Verge writer testing the new site was prompted to check their email for an access code before getting into their account, but was never asked for the rotating authenticator code they had set up previously. Either way, the app-based two-factor setup appears to be out of the login flow.
More worrying details have surfaced alongside the missing codes. The Verge found that after logging in, it could change the account password without entering the old one, and some users report they cannot find a way to remove saved payment details, though accounts on Humble Bundle can have card information stored. Users on the Humble Bundle subreddit have reacted sharply, with some arguing the site should restrict password changes or be taken offline until the problems are fixed.
PC Gamer speculates the removal was probably not intentional, and has asked Humble Bundle whether the change was deliberate and whether it will be reversed. Requests for comment to Humble Bundle owner IGN Entertainment and IGN parent company Ziff Davis have so far gone unanswered.