Introducing the Ban API and Alt Account Detection

Am I supposed to be allowed to ban myself + my colleagues?

1 Like

Alt detection does NOT work

I would recommend not to ban yourself.
I made a mistake banning myself because I wanted to test out that update they had couple of months ago and I unable to unban myself so I had to unban myself then open my second account to join where I got banned then when I join, it worked.

2 Likes

Sure, it can’t work. Roblox made this feature for a sense of false security. There’s hundreds of ways to bypass it.

4 Likes

I think that not having the possibility to modify the ban is quite horrendous, even through the dashboard. It lacks this really important feature

2 Likes

It would be so cool to integrate the bans directly on the Roblox homepage (if you are banned from a game, you would have a lock on the play button, more clean than getting kicked from the game in my opinion)

5 Likes

Is this suggesting that the Kick API may be depreciated further down the road?

The biggest turn down of this API is the text filter. During the time that I have been using it, the majority of simple reasons got filtered. It honestly makes me want to return to using the old method.

In my opinion, there should be a filter. Though it shouldn’t be as harsh as it is right now: it should only filter words, which actually violate Roblox’s Terms of Service.

I looked up to this update when it first came out. However, after doing practical tests, I might want to reconsider my point of view, unless something is done with the horrible text filter.

Most common reasons, which get filtered:

  • “Outlining, violating Rule 6 in Classic Nations.”
  • “Intentionally blocking others from expansion, violating Rule 6 in Classic Nations.”
  • “Controversial nation customization, violating Rule 9 in Classic Nations.”
  • “Violation of Roblox’s Terms of Service, violating Rule 11 in Classic Nations.”

I would be assuming it’s caused by the specific format I am using. But I don’t see a reason why it should be filtered in the first place!

9 Likes

Is there a way to just detect if a player is an alt account? Let’s say we have a pvp arena wth a wins leaderboard and only want legitimate wins, so not people killing their alts repeatedly, a function to check if a player is fighting their own alt and not counting the win could do wonders. Something like player:IsAlternativeAccountOf(otherPlayer).

5 Likes

I tried testing it but it has a problem with alt account detection. Can you please fix the alt account detection?

3 Likes

This system remains practically useless, numerous bacon exploiter alts make it past detection so easily. When is this system going to be improved? It’s misleading developers into thinking that it actually prevents alt accounts when it blatantly fails. Even CPU-timer lua detection scripts work better against alt-hopping than this. Why does this still, months later, fail against the most important and blatant use-case?
Please improve this system, game security shouldn’t be something that gets half-baked and left to rot.

6 Likes

I looked at the OpenCloud website found here: UserRestriction | Documentation - Roblox Creator Hub

The only request option I see is modifying a ban, can we please get access to a request to ban people too? That would be awesome.
(Read under)

1 Like

You can.

Set gameJoinRestriction.active to true and parse whatever duration you need, don’t pass a duration for permanent bans.

Code Example (what i'm doing)
const user_id = parseInt(key.split("_")[1]);
    const url = `https://apis.roblox.com/cloud/v2/universes/6445283861/user-restrictions/${user_id}?updateMask=gameJoinRestriction`;

    const body = {
      gameJoinRestriction: {
        active: true,
        duration: true_duration,
        privateReason: "Check Irity cases for more information",
        displayReason:
          rule_violation !== "0"
            ? `We believe you have violated rule ${rule_violation}. You can appeal this ban by joining our Discord server.`
            : `We believe you have violated one of our rules. You can appeal this ban by joining our Discord server.`,
        excludeAltAccounts: !ban_alts,
        inherited: true,
        startTime: new Date().toISOString(),
      },
    };

    try {
      await axios({
        method: "PATCH",
        url: url,
        headers: {
          "x-api-key": process.env.BAN_API_KEY,
          "Content-Type": "application/json",
        },
        data: body,
      });

      return true;
    } catch (error) {
      console.log(error);
      return false;
    }
2 Likes

Oh, thanks, I completely missed that one.

Edit: Thank you so much, I made it work!

2 Likes

This is a smart idea, however, it would easily be abused.

When Roblox receives a Right to be Forgotten (RTBF) request, we respond and delete records as required. Roblox users can submit requests for deletion, and other rights regarding their data, via the Roblox Support Form. There is no need for you to unban these users. Any known alternate accounts will remain unable to join the game, even after the RTBF process has been completed.

2 Likes

The alt detection really sucks. Thanks Roblox.
We’ve had to ban tons of alternative accounts due to the fact the BanAsync/Ban API alt detection keeps failing.

3 Likes

Just a question, how does the Ban API works? Does it detect the user’s Email, IP, Associated accounts and his HWID?

It’s just a simple question, since i think a bypass can be possible by switching the IP using VPNs and Devices.

1 Like

The detection of alt accounts is very poor. Please help improve the alt account detection using methods such as detecting from MAC address or HWID, or other components in the computer. If there is multi-layer detection, it will be more difficult to bypass it using only VPN or Proxy. This would be very beneficial for people who do not know how to bypass it.

2 Likes

haven’t tested it myself but i’d assume ip address. which is pretty stupid since most people exploit on mobile and there’s dozens of vpn apps on the google play store. they could’ve at least made it so it’s mac address based which will be near “impossible” to bypass on an android device.

2 Likes