Kotaku reports that Humble Bundle’s redesigned settings page no longer lets you add or update two-factor verification. Until that changes, keep your password strong and unique, secure your email account, and redeem game keys promptly.
Key takeaways
- Kotaku reports that Humble Bundle’s redesigned storefront settings page no longer has an option to add or update two-factor verification methods.
- PC Gamer notes that Humble Bundle’s support pages still discuss two-factor verification, even though the settings page no longer shows it.
- It is not publicly known whether two-factor verification set up before the redesign still protects existing accounts.
- If an account cannot use two-factor verification, its password and the security of the linked email address matter even more.
- Once you redeem a game key on a platform such as Steam, that platform’s own security protects the game.
What has changed on Humble Bundle’s settings page?
Humble Bundle is an online storefront that sells games, software, ebooks and other digital products, often in themed bundles. It recently got a visual redesign. According to The Verge, citing Kotaku, the account settings page in the new design no longer offers a way to add or update two-factor verification methods.
Two-factor verification, often called two-factor authentication or 2FA, asks for a second proof of identity on top of your password. That proof is usually a short code from an authenticator app, a text message or an email. If someone steals your password, they still cannot sign in without that second factor.
The reports describe something missing from the page, not a confirmed change in policy. Humble Bundle has not publicly said, in the material available here, whether the setting was removed on purpose, moved somewhere else or left out by mistake.
Why is this in the news now?
The redesign is recent, and users and journalists spotted the missing option soon after it launched. Kotaku reported the absence, and PC Gamer added that Humble Bundle’s support pages still describe two-factor verification. The Verge summarised both reports.
The gap between the help pages and the live site drew attention. When a support article explains a feature that users cannot find, they cannot tell whether the feature still exists. For a security feature, that uncertainty matters more than it would for a cosmetic setting.
The source material does not say how long the option has been missing or when, or whether, it will return.
What background does a newcomer need?
A Humble Bundle account usually holds three valuable things:
- Unredeemed game keys. Many purchases come as keys that you redeem on another platform, such as Steam. A key sitting unredeemed in a Humble library can be copied and used by anyone who gets into the account.
- Stored payment details. Shoppers who save a card or payment method for convenience could see it misused if someone takes over the account.
- Subscription access. Humble offers subscription products, and access to the monthly content is tied to the account.
Attackers often try usernames and passwords leaked from other websites. This is called credential stuffing, and two-factor verification is one of the main defences against it. Without 2FA, anyone who reuses a password from a breached site is much more exposed.
For many online services, the email address on the account is the recovery route. If an attacker controls your email, they can usually reset your password, so the security of your inbox matters as much as the Humble password itself.
Who is affected, and how?
Users who never turned on two-factor verification appear to have no way to turn it on from the redesigned settings page. They depend entirely on their password.
Users who set up two-factor verification before the redesign are in a less clear position. It is not known from the reports whether their existing protection still works. It is also unclear whether they can change it, for example after getting a new phone or losing an authenticator app. If you cannot update your second factor, you could be locked out, or the protection could quietly lapse.
The risk is highest for people with large unredeemed libraries, stored payment details or reused passwords. The risk is lower for people who redeem keys straight away and do not save payment information.
Where do informed observers disagree?
The reporting does not settle several open questions, and reasonable readings differ:
- Oversight or decision. Missing settings after a redesign are sometimes accidental: a feature is not carried over to the new interface in time. Others will see it as a deliberate reduction in security options. The available material does not show which is true.
- How serious it is. Some will say a storefront whose keys get redeemed elsewhere needs less protection than a bank or email account. Others point out that unredeemed keys and saved payment methods are valuable and easy to resell.
- Whether help pages are enough. PC Gamer notes that support pages still cover two-factor verification. That might mean the feature can still be reached another way, or it might mean the documentation is out of date.
Until Humble Bundle explains what happened, these questions stay open.
What should you do to protect your Humble Bundle account?
You do not need to wait for an official statement to lower your risk. These steps work whatever the status of the setting:
- Use a unique, strong password. If your Humble password is used anywhere else, change it to one you use nowhere else. A password manager can generate and store a long random password.
- Secure the linked email account. Turn on two-factor verification on your email provider, preferably with an authenticator app or a hardware security key. This protects the main recovery route for your Humble account.
- Redeem keys promptly. Move game keys to the platform they belong to as soon as you can. Once a key is redeemed on Steam or another store, that account’s own security protections apply.
- Review saved payment methods. If you do not need a card saved for convenience, consider removing it from the account.
- Check your purchase and key history. Look for keys revealed or redeemed that you do not recognise. That can be an early sign of unauthorised access.
- Look for the setting yourself. Check the settings page and the support documentation in case the option has been restored or moved. If you depend on 2FA, contact Humble Bundle support and ask about the status of your existing setup.
- Watch for phishing. News stories about security changes sometimes lead to fake “verify your account” emails. Sign in by typing the site address yourself, not through links in unexpected messages.
None of these steps fully replaces two-factor verification. Together, though, they reduce both the chance of a break-in and the damage one could do.
What should you watch for next?
The most useful sign will be an official statement from Humble Bundle saying whether two-factor verification is still supported, and how. Check whether the setting comes back to the redesigned settings page, whether the support pages are updated to match the live site, and whether existing two-factor setups keep working.
If the option comes back, re-check that your account has a working second factor and that you have saved any backup or recovery codes. If Humble confirms that the option has been removed, the steps above become your main protection for the account.
Frequently asked questions
Has Humble Bundle removed two-factor authentication?
Kotaku reports, as summarised by The Verge, that Humble Bundle’s redesigned settings page no longer has a way to add or update two-factor verification methods. PC Gamer notes that the company’s support pages still discuss the feature. It is not publicly known whether this is deliberate, temporary or accidental, or whether existing two-factor setups are affected. Check the settings page and official announcements for the latest position.
Does my existing Humble Bundle 2FA still work?
That is not clear from the available reports. They describe the settings page no longer offering a way to add or change two-factor methods, but they do not confirm what happens to protection set up earlier. If you rely on it, contact Humble Bundle support to confirm its status. Make sure your password is unique and your email account is secured in the meantime.
How can I secure my Humble Bundle account without two-factor verification?
Use a long, unique password stored in a password manager, and never reuse it on other websites. Turn on strong two-factor verification for the email account linked to Humble, since email is usually the password recovery route. Redeem game keys promptly, remove saved payment methods you do not need, and check your purchase history for anything you do not recognise.
Should I redeem my Humble Bundle Steam keys now?
Redeeming keys promptly is a sensible precaution. An unredeemed key stored in your Humble library can be used by anyone who gets into your account. Once it is redeemed on Steam or another platform, it is tied to that account and covered by that service’s own security measures, including any two-factor verification you have turned on there.
Why does the email account matter for Humble Bundle security?
Most online stores, including Humble Bundle, let users reset a forgotten password through the email address on the account. If someone gains access to that inbox, they may be able to reset your Humble password and take over the account. Protecting your email with a strong password and two-factor verification therefore indirectly protects your Humble library.
Is it safe to keep a payment card saved on Humble Bundle?
Saving a card is convenient, but it raises the cost of an account takeover. That is especially true while two-factor verification options are unclear. If you buy only occasionally, consider removing saved payment details and entering them at checkout instead. Also watch your bank or card statements for unexpected charges, and report anything suspicious to your card provider promptly.
Sources and further reading
- The Verge: summary of the reports that Humble Bundle’s redesign removed two-factor verification from the settings page
- Kotaku: original report on the missing two-factor verification option after the redesign
- PC Gamer: coverage noting that Humble Bundle’s support pages still discuss two-factor verification
- Humble Bundle support documentation: the company’s own help pages on account security and two-factor verification
Surfaced from the rss:verge signal “storefront security setting removed”. AI-assisted draft, editorially reviewed.
