The Humble Bundle storefront received a visual overhaul, but the update left out a security option that was available before. Users can no longer add or update two-factor verification methods through the settings page, a change first noted by Kotaku and confirmed by PC Gamer. Publications pointed out that Humble Bundle support pages still reference two-factor verification, and at least one writer had configured 2FA on the previous version of the site.
When logging in, an access code sent to email was required to enter the account. Once logged in, password changes could be made without providing the previous password. A password manager also showed a rotating two-factor code had been set up for Humble Bundle at some point, but the code was not requested during the login session described in the report. IGN Entertainment, which owns Humble Bundle, and its parent company Ziff Davis did not respond to a request for comment.
What was removed from the settings page
The settings page no longer includes fields or buttons to manage two-factor authentication methods. Previously, users could add new codes or rotate existing ones. The absence of those controls means account holders cannot update their 2FA setup through the interface, even if they still have active codes stored in authenticator apps.
How login behaves without the setting
Logging in now triggers an email-based access code. That step appears to be the only form of two-factor verification currently enforced. Password updates are possible from the account page without requiring the old password, which reduces the barrier for making changes but also means less friction for anyone who gains access to an account session.
What this means for users
Users who relied on the settings page to manage two-factor methods lose that ability. Anyone who had not already configured an authenticator app before the redesign may find themselves with fewer options to secure their account. The email code requirement provides some protection, but the inability to add or rotate 2FA methods from the dashboard is a gap for long-term account security.