Humble Bundle Redesign Removes 2FA and Other Important Account Security Features

Humble Bundle has removed two-factor authentication and other account security features in their new website redesign, leaving users at risk of their account being taken over and their credit card info being stolen.

The option to add two-factor authentication has been entirely removed from the security settings and it's no longer available on the login screen either.

Funnily enough, the Humble Bundle support site still recommends two-factor verification even though the feature has been removed.

Two-factor authentication requires you to know both your account password and a temporary code generated on one of your devices. You need to have both in order to access your account, so an attacker that has just your password from a data leak can't log in to your account.

They also removed authentication when changing your password, making it easier for attackers who are able to access your account while logged in to completely take it over.

When you attempt to change your email, no email is sent to the original email address to confirm the switch, again making it easier for an attacker to take over your account if they manage to get access a logged-in session.

The support page lists the completely wrong behavior here too: when you change your email, it sends a one-time code to the new email address, not the previously registered one.

Many other issues plague the redesigned site. When you sign up, it doesn't automatically log you in. It no longer differentiates between redeemed and unredeemed codes.

Speculation is rampant that the redesign is vibe coded. Epic games announced its new vibe-coded launcher not long ago, which came with a litany of issues at launch.

Proton CEO Andy Yen wrote in a slack channel that wanting to pentest newly-written code before pushing it live is "loser thinking" and recommended that they "stop lovingly handcrafting all our code and use AI more."

Vibe-coded apps like the ones shipped with Artcraft can allow users to get some of the functionality of expensive software like Photoshop from companies like Adobe that have predatory business practices.

However, redesigns of already existing software using AI can have disastrous consequences if not done with care.