Users of Humble Bundle—the pay-what-you-want game-bundle storefront that will also sell you books and software—have been alarmed by a new redesign that seems to have axed a foundational piece of login security tech.

The just-released new Humble Bundle website has no support for two-factor authentication whatsoever: users are unable to add it to their accounts, while those who had previously set it up on the old site design (including yours truly) are able to log in with just an email and password. At no point in the login process does the site ask you to input a 2FA code.

Humble Bundle does not address the removal of 2FA anywhere on its new site. In fact, the site's FAQs still feature articles encouraging users to make use of it to keep their accounts secure, which is currently impossible. I have reached out to Humble Bundle to ask if the change was intentional and if it will be reversed, and will update this piece if I hear back.

This is, to put it mildly, concerning. The point of two-factor (or multi-factor) authentication is to make user accounts—which, on Humble Bundle, may well have credit card info saved to them—more secure. Even in the event your account password became compromised, your attacker would be unable to get into your account without also having access to your 2FA codes, which are constantly regenerated and only valid for short periods of time. In a world where too many people have bad password hygiene, it's a vital bit of security tech.

Source link