As a Roblox developer, it is currently too hard ( actually impossible) to place limits on the location of a login session.
Recently I fell victim to social engineering resulting in a bad actor gaining unauthorized access to my Roblox account, bypassing authenticator app-based 2FA as well as Account Session Protection. How they accomplished this exactly is unknown to me however, so I am quite bewildered by the incident. You can read more about my incident and painpoint at this topic: Is it possible to limit sessions to your own country? - Help and Feedback / Platform Usage Support - Developer Forum | Roblox.
Regardless of their method, this could have been easily avoided. How? By limiting the location of where a Roblox account can be accessed. However, Roblox does not offer such a feature.
As such, today I am writing to propose a new layer of security on Roblox: The feature to limit the location which a Roblox account can be accessed. Imagine through your security settings, you now have a setting which can be optionally enabled, allowing you to limit where your Roblox account can be accessed. It can be based on city, country or just country. I am aware that Roblox cannot always be accurate at recognizing locations on a micro scale, so perhaps country-based whitelisting would be more optimal. Just country-based would also be better as a lot of people travel around inside the same country.
Like with any 2FA, this comes with risk a feature enabler has to accept. Consider the case where the feature enabler travels to a location that they did not whitelist. This is the risk (in other words, a 2FA lockout), and the feature enabler should have accepted this risk. To circumvent this issue, whitelisting should occur before travelling. This case should not be considered a valid issue affecting feature implementation consideration, however, as I can argue that you can be SMS-based 2FA locked out from changing a phone number or be locked out from auth-app-based authentication by getting a new smartphone or by deleting your authenticator app without syncing codes to a new location. The risk should be warned to the user before they are able to enable it. As always though, in the case things go wrong, backup codes could save the day.
If this issue were to be addressed, it would significantly decrease the risk of my Roblox account being compromised. In my experience, I recently had bad actors breach my account from Moscow, Russia as well as a town in North Carolina, USA. I do not live nor remotely access my Roblox account anywhere near such locations.