Humble Bundle has resumed requesting verification codes sent by email during login, after a redesign of its website that eliminated two-step authentication options. The partial recovery was documented by the Dutch outlet Tweakers on Friday (13), but the use of authenticator apps remained unavailable, leaving accounts without one of the protections previously offered.
The change prompted complaints among users of the digital store, known for selling bundles of games, software, and other content. After the interface update, the option to configure or modify authentication methods disappeared from the security settings.
The problem was also identified by The Verge. In a test published on November 12, journalist Jay Peters was able to access his account using a code received by email, but he did not need to enter the temporary authentication code he had previously set up. He was also able to change the password without providing the old password.
Email verification does not replace an authenticator app
Before the redesign, Humble Bundle allowed the use of six-digit temporary codes generated by apps, such as Google Authenticator. This mechanism, known as TOTP, creates one-time passwords that expire after a short interval.
Email verification adds a step to the login process but depends on the security of the inbox itself. TOTP, meanwhile, uses a secret stored in the authenticator app, offering protection independent of email access.
According to Tweakers, requesting the code by email became the standard procedure, with no option to enable or disable verification. Access via authenticator apps or security keys was not available in the checks reported by the outlet.
The redesign also generated complaints related to browsing the game library and managing activation keys. However, there was no evidence in the reports consulted that the authentication change had caused account intrusions or data leaks.
As of the publication of the reports, there was no confirmation of when the previous authentication methods would be restored. IGN Entertainment, the owner of Humble Bundle, and its parent company, Ziff Davis, had not responded to a request for comment from The Verge.
