Humble Bundle’s new website has no two-factor login. Anyone who has your password gets into your account, and into every game key you haven’t redeemed yet.
I checked my own account this morning, 12 November. The site asked for my password and nothing else, and nothing in the account settings lets you add a second step any more.
Humble relaunched its website this month. Ziff Davis, the company that owns Humble Bundle, told investors last week that the relaunch was “days away”. On 11 November, the Pirate Software account on X, run by game developer Jason Hall, warned that 2FA was gone from the login flow and “doesn’t appear anywhere in your settings”. Threads on ResetEra, SpaceBattles and Hacker News followed. Humble hasn’t commented publicly, and no major outlet had covered it when we published.
Source: Privacy Affairs · 2026-11-12