Humble Bundle's Redesign Lost 2FA. Every Migration Plan Should Learn From It
Humble Bundle launched a big redesign this week. Within hours people noticed that something important hadn't made the move to the new site: two-factor authentication. I've led enough rebuilds to know how this happens. I
Humble Bundle launched a big redesign this week. Within hours people noticed that something important hadn't made the move to the new site: two-factor authentication.
I've led enough rebuilds to know how this happens. It still made me wince.
What actually changed
On November 12, Kotaku tested the new site on its own account and confirmed three things:
- The option to add or remove 2FA is gone from the security settings.
- A logged-in user can set a new password without entering the current one.
- Changing the account email doesn't send a verification to the old address.
PC Gamer and GamingOnLinux reported the same problems. Users also complained about library features that disappeared, like filtering redeemed and unredeemed keys. Reports say that accounts which had 2FA on the old site now log in with just email and password, though at least one user on a forum says theirs still works, so the rollout may be uneven.
When the reports came out, Humble hadn't explained whether this was intentional, temporary or a half-finished migration.
Why the combination matters
One missing feature is a bug. These three together are a takeover path.
Picture a house. 2FA is the deadbolt. Asking for the old password is the door chain. Telling the old email about a change is the alarm that rings on your phone. Take away all three, and anyone who gets a foot in the door (a reused password, a session left open on a shared PC) can change the locks and the address before you notice.
On a store full of game keys and saved cards, that's not theoretical.
About the "vibe-coded" accusation
A lot of the anger online says the new site was built quickly with AI and nobody checked it. Kotaku notes that some users think it looks like other AI-built sites. Nobody has shown proof, and I'm not going to pretend I know.
Honestly, it doesn't change the lesson much. I've seen humans with no AI anywhere near the project do exactly this. The failure isn't in who typed the code. It's that nobody had a list of "things the old system did that users never see, but rely on".
Where AI does make it worse is speed. When rebuilding a screen takes an afternoon instead of a sprint, it's very tempting to skip the slow, boring part: proving the new thing does everything the old one did.
The migration checklist I'd actually use
When we rebuild something, I now ask for a "parity list" before anyone touches the design. Security goes at the top:
- Login: every MFA method the old system supported, including accounts already enrolled.
- Re-authentication: current password (or a fresh MFA prompt) before changing password, email, or payment details.
- Notifications: an email to the old address whenever the email or password changes.
- Sessions: logout everywhere, "remember me" behaviour, session expiry.
- Money: confirmation before any charge, and the ability to remove saved cards.
Each item gets an end-to-end test that runs against the old system and the new one. If the new one fails, it doesn't ship. That sounds slow. It's much faster than an apology post.
To be fair to Humble's team: big migrations always break something, and I've shipped worse things than a missing filter. But a missing filter annoys people. A missing lock costs them money.
If you have a Humble account
While this gets sorted out, a few simple steps:
- Use a password there that you don't use anywhere else. A password manager makes this painless.
- Remove saved payment cards for now. Kotaku recommends the same.
- Turn on 2FA for the email account linked to Humble. If someone can't get into your email, it's much harder to take over everything else.
- Keep an eye out for "your email was changed" or "your password was changed" messages, and act on them quickly.
The bigger point
Users never praise you for the security features that work. They only notice when one goes missing, and then they remember for years. That's why it belongs in the migration plan, not in the "we'll add it back later" column.
So here's my question: would you keep buying from a store after a slip like this, or wait until it's fixed? Why?
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.