GoKawiilHumble Bundle redesign removes two-factor authentication and password confirmations
Humble Bundle launched a new website that reportedly eliminated two-factor authentication, allowing accounts to be secured by password alone. Users can also change their password or email address without re-entering their current password, and the site allegedly reinstated one-click payments despite that practice being illegal in some jurisdictions. The findings were surfaced by an IT security professional streaming live and corroborated on a Reddit thread; Humble Bundle has not yet publicly responded.
GoKawiil's interpretation of the reporting above, not reported fact.
The reported removal of basic account-security safeguards could leave users vulnerable to account takeovers with little recourse beyond an after-the-fact notification email. The claim that the site's 'security provider' is an AI company suggests, according to observers, that automated or AI-assisted development may have replaced standard security review processes. If one-click payments were indeed re-enabled without proper authorization, that could expose Humble Bundle to regulatory scrutiny in regions where such practices are restricted.
- Humble Bundle's new site reportedly lacks two-factor authentication entirely.
- Password and email changes can allegedly be made without confirming the existing password.
- One-click payments were reportedly re-enabled, which may violate regulations in some regions.
YubiKey 5C NFC Security Key — With sites like Humble Bundle apparently dropping basic account protections, it's worth taking your own security into your own hands. A hardware security key like the YubiKey lets you enforce strong authentication on accounts that actually support it (password managers, email, etc.), reducing the damage if a service you use gets hijacked.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: forums.spacebattles.com, 2026-11-12
Published there as: “Humble Bundle just killed most of their security through vibecoding”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.