Introducing Updates to Our Safety Protections and Parental Controls

[TimeFrenzied (Aura Farmer)]

@Mimi_Dev

Stealing your login token does not bypass any other instances where your 2FA is requested, like when attempting to change your password. They don’t have the answer to your 2FA if they have bypassed login entirely.

Never said it did.

@Mimi_Dev

You do not need an email to bypass a PIN, they are not connected at all. The pin had infinite retries, which made it possible to bypass with botted password guessing.

True, but it’s still an added security layer and can COEXIST with 2FA

see:

Some sensitive actions can be done without additional verification (2fa gate or "pin")

There’s a balance between safety and annoying users, which I’m sure you already know, it’s important to note. I personally would prefer a code per sensitive action. However, it seems like most people here want the less secure and more ease-of-use thing (a one-time code/PIN to be able to change settings). The one-time code here does have drawbacks, as you mention here: That said, I think some don’t understand the difference or like the idea of the PIN more. Maybe it’s a familiarity thing, not…

https://devforum.roblox.com/t/how-do-you-feel-about-the-parent-pin-being-removed/3264227/15?u=timefrenzied

@Mimi_Dev

In order for someone to have your 2FA log in they either have to have your phone in their hand (for authenticator app) or already have broken into your email (for email codes) OR have swapped your SIM card to run on their phone instead (if you only use text codes). I strongly recommend only using authenticator app, because that random person who stole your login key on discord, doesn’t have your phone.

@TimeFrenzied

this is the same as telling support you lost your phone for 2FA.