Introducing Updates to Our Safety Protections and Parental Controls

[Mimi_Dev]

The parent PIN was not intended as a security feature and can be bypassed by people who have the means to access your account. The only person who this PIN would stop is your friend who logged into your Roblox account while you weren’t in the room. Token loggers can break the PIN.

Roblox asks for your 2factor authentication when attempting to change things like your password or email. Turn 2factor on to protect your account.

[tuffdog04 (mike)]

When will blocking of specific experiences be a feature? There are certain experiences with undertones of which are rated for Everyone that I do not want any of my siblings accessing at all.

[TimeFrenzied (of Xyaery)]

@Mimi_Dev

The parent PIN was not intended as a security feature and can be bypassed by people who have the means to access your account.

It cannot. They would need your Email for this; this is the same as telling support you lost your phone for 2FA.

If they had the 2FA to login to your account in the first place, they would probably be able to use the same code before it expires to steal your limited. As I’m saying, extra security through a PIN-like system isn’t required, but it is beneficial.

[metatablecatmaid (metatablecat)]

@Roblox

Reminder about updates to the Roblox parent PIN

As previously announced over email, as of today, you are no longer able to set or use a parent PIN on your Roblox account. As always, if you are interested in an added layer of security on your account, you can set up 2-factor authentication .

I guess my feature request just got ignored then. Revert this. Now.

[Mimi_Dev]

There are a lot of misconceptions here.

1. Stealing your login token does not bypass any other instances where your 2FA is requested, like when attempting to change your password. They don’t have the answer to your 2FA if they have bypassed login entirely.
2. You do not need an email to bypass a PIN, they are not connected at all. The pin had infinite retries, which made it possible to bypass with botted password guessing.
3. In order for someone to have your 2FA log in they either have to have your phone in their hand (for authenticator app) or already have broken into your email (for email codes) OR have swapped your SIM card to run on their phone instead (if you only use text codes). I strongly recommend only using authenticator app, because that random person who stole your login key on discord, doesn’t have your phone.

[TimeFrenzied (of Xyaery)]

@Mimi_Dev

Stealing your login token does not bypass any other instances where your 2FA is requested, like when attempting to change your password. They don’t have the answer to your 2FA if they have bypassed login entirely.

Never said it did.

@Mimi_Dev

You do not need an email to bypass a PIN, they are not connected at all. The pin had infinite retries, which made it possible to bypass with botted password guessing.

True, but it’s still an added security layer and can COEXIST with 2FA

see:

Some sensitive actions can be done without additional verification (2fa gate or "pin")

There’s a balance between safety and annoying users, which I’m sure you already know, it’s important to note. I personally would prefer a code per sensitive action. However, it seems like most people here want the less secure and more ease-of-use thing (a one-time code/PIN to be able to change settings). The one-time code here does have drawbacks, as you mention here: That said, I think some don’t understand the difference or like the idea of the PIN more. Maybe it’s a familiarity thing, not…

https://devforum.roblox.com/t/how-do-you-feel-about-the-parent-pin-being-removed/3264227/15?u=timefrenzied

@Mimi_Dev

In order for someone to have your 2FA log in they either have to have your phone in their hand (for authenticator app) or already have broken into your email (for email codes) OR have swapped your SIM card to run on their phone instead (if you only use text codes). I strongly recommend only using authenticator app, because that random person who stole your login key on discord, doesn’t have your phone.

@TimeFrenzied

this is the same as telling support you lost your phone for 2FA.

[walywhale (ExpiWentOutForMilk)]

LFG! IVE HAD THIS PROBLEM ITH MY PARENTAL CONTROLS WHILE BEING 18 where i couldnt play games for ages 13+ because of my defunct email still receiving 2FA codes! Tysm roblox! I cant believe i can play my fav scp games that i wasted robux on again!

[Mimi_Dev]

It is not and never was added security. Anyone who has the means to access your account without permission, except for maybe your siblings/friends irl, can and will break it to get what they want off your account. Side note, 2FA also already shows up when trading limiteds as well.

[TimeFrenzied (of Xyaery)]

It is added security on top of 2fa, I really don’t know what to tell you. Also FYI I suggested a PIN-like system coming back as an improvement as a security feature. Where you could use patterns, questions, and add a lockout in a certain amount of tries (thought of this one on the spot so like, don’t question me if you don’t see it)

Some sensitive actions can be done without additional verification (2fa gate or "pin")

Edit: This post was revamped to be more of a suggestion for toggleable features for 2FA similar to what the PIN used to have as features With one of the newest updates to Roblox Safety the so called “Parent PIN” was removed from the website. This PIN was used for other reasons than just parenting a account tho. My suggestion together with ideas of other people is to re-add a PIN feature but make it better than the “Parent PIN”. The “Account PIN” (or whatever Roblox would want to call it) cou…

[CrimsonForce (Kyle)]

@Roblox

As a reminder of our July announcement , we are also updating our content access policies for users under 13. Users under the age of 9 will only be able to access experiences with a content label of “Minimal” or “Mild” by default.

I said it when this update was first announced, but the new terms that are being used make games seem like they’re aged higher than they actually are. Changing terminology from “All Ages” to “Maturity: Minimal” might be offputting to parents who try to make sure their kids are playing age-appropriate games. I’ve already had multiple people reach out to me asking if my games are no longer rated as kid friendly

[TimeFrenzied (of Xyaery)]

@CrimsonForce

I’ve already had multiple people reach out to me asking if my games are no longer rated as kid friendly

Even I’m having trouble believing this.

[VAC9]

I absolutely love the new Interference for parental controls and I’m glad I’ll be able to have more safety controls over my younger siblings accounts but i have a few questions.

Chat Settings

Will we be able to restrict access to in game chat to Friends only in the future? Chatting is a key and needed feature to play easily with friends on Roblox. I personally manage every single friend request. and it would be nice to allow my siblings to connect with friends from school on chat because currently i have it turned Off because i do not want strangers to be able to talk to them.

Experiences

Will there be a way to block certain experiences on an account in the future? There are a few games that i believe don’t have the best playerbases and i would not want them to play.

Ingame Audio

Will there ever be a way to block audio played by other users inside an experience? Many games have a external boombox game pass and while unfortunately Roblox try’s their best to moderate inappropriate content on the platform sometimes inappropriate audios can slip through moderation and unfortunately make their way into public experiences.

[TimeFrenzied (of Xyaery)]

@VAC9

Will there be a way to block certain experiences on an account in the future? There are a few games that i believe don’t have the best playerbases and i would not want them to play.

And honestly, I don’t want this to happen but if you’re gonna do this

you should separate the content into categories so that parents can choose, for example, some may blacklist crude humor or blood but allow violence etc.

[vltsna]

Well, at least now we have this:

[2jammers]

a pin is very easy to crack eventually, similar to pass guessing
it’s also very weak by a security standpoint, and most features already require a proper authentication app instead of the pin. the only place the pin is used is when changing parental control related settings, and those pose almost 0 security risk.

[TimeFrenzied (of Xyaery)]

We don’t need to go to a website and solve a captcha to open our phones lol

[2jammers]

the reason a 4-6 number passcode is used on phones is because you can’t even attempt to bruteforce unless you have the phone physically

[TimeFrenzied (of Xyaery)]

True. I was pretty much making a very simplified argument to explain why we should have at least the option to use a pin. Probably falls flat in a non simple subject.

[metatablecatmaid (metatablecat)]

You physically need the phone, also most modern phones will lock themselves down if they detect bruteforcing.

[abidbmt]

Ah ok if Roblox now asks you for 2FA when changing passwords its fine, it didnt used to require 2FA before.