Humble Bundle’s new redesign inexplicably removes 2-factor authentication, dramatically weakening account security

Humble Bundle’s redesigned website appears to have removed two-factor authentication (2FA), leaving accounts protected only by an email address and password. The change matters because customers may have payment details saved, and 2FA is intended to prevent access even if a password is stolen.

Users who had enabled 2FA on the previous site can now log in without entering a code, and new users cannot enable it. Humble Bundle’s FAQs still recommend 2FA, but the company had not explained the change or confirmed whether it was intentional; the article says it had been contacted for comment. Some users also report difficulty removing saved payment details, so the article advises considering their removal while 2FA remains unavailable.