Introducing the Ban API and Alt Account Detection

Other than easy setup, honestly the only benefit to this feature at the moment is alt account detection. Making your own custom ban system with DataStores seems to outweigh everything about Roblox’s native ban API.

I want to make a custom ban screen that shows detailed information about the ban and potentially allows for an in-game appealing system. Roblox’s ban system just extends from the stock kick dialog which doesn’t allow for much customization at all. And it doesn’t even prevent banned users from leaving an unfair downvote, which I was really hoping would come with this feature.


Possible Feature Custom Roblox
Custom detailed ban screen Yes No
Appeal in-game Yes No
Display reason prone to filtering No Yes
Display reason character limit No Yes
Private reason Yes Yes
Ban history Yes Yes
Automatic eviction Yes Yes
Universe-wide bans Yes Yes
Custom ban duration Yes Yes
Open Cloud usage Yes Yes
Alt account detection No Yes
Ban shown on game page No No
Prevent unfair downvotes No No
7 Likes

This is a great new feature for all developers to get their hands on – especially the suspected alt account removal. The only thing that may be concerning is false flagging of an alternate account.

Going through the new API and creating ban/unban commands, I think it would be nice to have a few things added/introduced within the two methods:

  • An optional field to identify via name, userID, etc. who ran the ban command within the ban config.
    Currently I have this hardcoded to be added within the private notes but a dedicated field for this may prove useful.

  • An optional field to identify via name, userID, etc. who ran the unban command within the unban config.
    From what I can tell, the unban command doesn’t have a field for that, or even a private notes field (which brings me to my last suggestion). The only thing you can provide (from what I gathered from the API) is the userID of the person/people you want to unban.

  • An optional field for private notes within the unban config.
    This would be nice to have as a log for the same reasons having private notes for the ban method is handy.

its possible to detect alts with custom ban system

You can ignore this its just my response to roblox's new ban api update (in the same exact post)

big games (and other developers who abuse datastore bans against people who play their game) will never use this because they don’t want to bow down to roblox’s guidelines behind Ban API

it would be nice if you guys replaced “leave” button with “appeal” instead so you could appeal in-game just small feature request

moving on

someone already bypassed this i also know how to bypass this alt detection however i won’t say how to do that or where did i find it because i don’t want to violate roblox’s rules here on the devforum so im just saying its bypassable and you can bypass Ban API

I don’t think this is a good idea, because the games players get banned from could be less strict or more strict with their rules, so if you see someone has been banned a lot then it could be some friends messing around or a game with heavy moderation. This will likely cause people to be banned falsely.

image
I banned my alt account and so it kicked me(my main), firstly why can you ban yourself if you can ban yourself does that mean you can permanently ban yourself from your own game. Because the ban api only works on live server you needs someone to unban you if you accidentally perma ban yourself. This is a stupidly broken flaw and you can’t even get the ban history on studio so the huge limitation for dev case and having a custom plugin is not possible.


test doesn’t apply as actually working so doing it on studio is pointless :sob: can’t even get ban history just had a good idea to makes a plugin.

A griefer can basically lock you out of your own game with this exploit(Someone abusing their access to the ban api).

2 Likes

I also ran into this. I filed a bug report for this issue:

2 Likes

why would it be a bad idea to allow bans that carry across games?

yeah something like that is what i meant

1 Like

find out the hashing algorythm and then brute force all the ips to find the users ip very good suggestion of yours :pray:

1 Like

ok have fun guessing millions of possible combinations lol

1 Like

Well thats in the case of ipv6, ipv4 is only 4 billion so :person_shrugging:

1 Like

it doesn’t even have to be their ip address, my suggestion was that there could be some sort of code generated by roblox’s backend to identify users without revealing their information (e.g. a uuid such as dfc7efd9-9fc8-42a8-b4a0-b39006fa2252 could correspond to a certain user). i am aware that hashing and encrypting don’t make something 100% unguessable, but there are different measures that can be taken to make it harder to guess

roblox doesn’t need to add this or anything but i’m just saying that there might be some people who would want a way to blanket ban. i personally don’t have a reason to ban people from other games but i know some people who make separate games that are intended to be used to claim free ugc items for example. ip addresses are meant to be public in terms of traffic but i understand that people prefer to keep them hidden

I ran into an issue when testing it

Hey, the limitation that if the text filter fails the ban won’t be applied is particularly annoying to work with.

Roblox filtering isn’t particularly easy to work around and the feedback on failure is not very good which makes this is a pretty big problem. It often filters a lot of things that should realistically not be filtered in other locations so unless the ban message filtering is fundamentally different this will likely cause problems.

It would be a lot better if the filtered message just gets filtered but still applied. Alternatively I’d even be happier if the ban message is erased and something like “Ban message filtered” was displayed or something, or just a generic ban message. But a full on failure means that banning someone is not necessarily reliable and that’s a big problem.

There is no good way to easily know if a particular ban message will be filtered or not ahead of time and if your ban messages are automatically filled in with any information or context about the ban and it fails then you have a pretty big problem because now the person you tried to ban isn’t banned.

8 Likes

Even custom ban systems can utilize the cloud API, since they rely on the datastores. All you would need to do is update the values of the DB using the datastore cloud apis.

The real benefit to the built in ban system is faster ban detection, easier setup, and you don’t have to worry about maintaining it. The alt detection in its current state is worse than what devs can do already do with device information and os.clock(). While it wasn’t always reliable (especially upon restarting their computers), it allowed me to catch some alternate accounts in our games and take action against them.

Good point, I was specifically referring to the UserRestrictions API though, I guess I just didn’t word that very well.

Yes, Roblox’s system is easier to set up, but doesn’t provide much customization. So at the cost of managing everything yourself instead, you can customize the ban screen however you want. In this case, alt detection would be the only thing I’m missing out on.

1 Like

Is there a reason on why it still says “Service not live”?
image

1 Like

I’m not experiencing any lag…?

I agree with this, but maybe it should be a settings toggle like Allow HTTP service

how it can detect when you are on a alt? good job roblox i really appreciate it!!