Introducing Updates to Our Safety Protections and Parental Controls

[metatablecatmaid (metatablecat)]

@Roblox

Reminder about updates to the Roblox parent PIN

As previously announced over email, as of today, you are no longer able to set or use a parent PIN on your Roblox account. As always, if you are interested in an added layer of security on your account, you can set up 2-factor authentication .

I guess my feature request just got ignored then. Revert this. Now.

[Mimi_Dev]

There are a lot of misconceptions here.

1. Stealing your login token does not bypass any other instances where your 2FA is requested, like when attempting to change your password. They don’t have the answer to your 2FA if they have bypassed login entirely.
2. You do not need an email to bypass a PIN, they are not connected at all. The pin had infinite retries, which made it possible to bypass with botted password guessing.
3. In order for someone to have your 2FA log in they either have to have your phone in their hand (for authenticator app) or already have broken into your email (for email codes) OR have swapped your SIM card to run on their phone instead (if you only use text codes). I strongly recommend only using authenticator app, because that random person who stole your login key on discord, doesn’t have your phone.

[TimeFrenzied (of Xyaery)]

@Mimi_Dev

Stealing your login token does not bypass any other instances where your 2FA is requested, like when attempting to change your password. They don’t have the answer to your 2FA if they have bypassed login entirely.

Never said it did.

@Mimi_Dev

You do not need an email to bypass a PIN, they are not connected at all. The pin had infinite retries, which made it possible to bypass with botted password guessing.

True, but it’s still an added security layer and can COEXIST with 2FA

see:

Some sensitive actions can be done without additional verification (2fa gate or "pin")

There’s a balance between safety and annoying users, which I’m sure you already know, it’s important to note. I personally would prefer a code per sensitive action. However, it seems like most people here want the less secure and more ease-of-use thing (a one-time code/PIN to be able to change settings). The one-time code here does have drawbacks, as you mention here: That said, I think some don’t understand the difference or like the idea of the PIN more. Maybe it’s a familiarity thing, not…

https://devforum.roblox.com/t/how-do-you-feel-about-the-parent-pin-being-removed/3264227/15?u=timefrenzied

@Mimi_Dev

In order for someone to have your 2FA log in they either have to have your phone in their hand (for authenticator app) or already have broken into your email (for email codes) OR have swapped your SIM card to run on their phone instead (if you only use text codes). I strongly recommend only using authenticator app, because that random person who stole your login key on discord, doesn’t have your phone.

@TimeFrenzied

this is the same as telling support you lost your phone for 2FA.

[walywhale (ExpiWentOutForMilk)]

LFG! IVE HAD THIS PROBLEM ITH MY PARENTAL CONTROLS WHILE BEING 18 where i couldnt play games for ages 13+ because of my defunct email still receiving 2FA codes! Tysm roblox! I cant believe i can play my fav scp games that i wasted robux on again!

[Mimi_Dev]

It is not and never was added security. Anyone who has the means to access your account without permission, except for maybe your siblings/friends irl, can and will break it to get what they want off your account. Side note, 2FA also already shows up when trading limiteds as well.

[TimeFrenzied (of Xyaery)]

It is added security on top of 2fa, I really don’t know what to tell you. Also FYI I suggested a PIN-like system coming back as an improvement as a security feature. Where you could use patterns, questions, and add a lockout in a certain amount of tries (thought of this one on the spot so like, don’t question me if you don’t see it)

Some sensitive actions can be done without additional verification (2fa gate or "pin")

Edit: This post was revamped to be more of a suggestion for toggleable features for 2FA similar to what the PIN used to have as features With one of the newest updates to Roblox Safety the so called “Parent PIN” was removed from the website. This PIN was used for other reasons than just parenting a account tho. My suggestion together with ideas of other people is to re-add a PIN feature but make it better than the “Parent PIN”. The “Account PIN” (or whatever Roblox would want to call it) cou…

[CrimsonForce (Kyle)]

@Roblox

As a reminder of our July announcement , we are also updating our content access policies for users under 13. Users under the age of 9 will only be able to access experiences with a content label of “Minimal” or “Mild” by default.

I said it when this update was first announced, but the new terms that are being used make games seem like they’re aged higher than they actually are. Changing terminology from “All Ages” to “Maturity: Minimal” might be offputting to parents who try to make sure their kids are playing age-appropriate games. I’ve already had multiple people reach out to me asking if my games are no longer rated as kid friendly

[TimeFrenzied (of Xyaery)]

@CrimsonForce

I’ve already had multiple people reach out to me asking if my games are no longer rated as kid friendly

Even I’m having trouble believing this.

[VAC9]

I absolutely love the new Interference for parental controls and I’m glad I’ll be able to have more safety controls over my younger siblings accounts but i have a few questions.

Chat Settings

Will we be able to restrict access to in game chat to Friends only in the future? Chatting is a key and needed feature to play easily with friends on Roblox. I personally manage every single friend request. and it would be nice to allow my siblings to connect with friends from school on chat because currently i have it turned Off because i do not want strangers to be able to talk to them.

Experiences

Will there be a way to block certain experiences on an account in the future? There are a few games that i believe don’t have the best playerbases and i would not want them to play.

Ingame Audio

Will there ever be a way to block audio played by other users inside an experience? Many games have a external boombox game pass and while unfortunately Roblox try’s their best to moderate inappropriate content on the platform sometimes inappropriate audios can slip through moderation and unfortunately make their way into public experiences.

[TimeFrenzied (of Xyaery)]

@VAC9

Will there be a way to block certain experiences on an account in the future? There are a few games that i believe don’t have the best playerbases and i would not want them to play.

And honestly, I don’t want this to happen but if you’re gonna do this

you should separate the content into categories so that parents can choose, for example, some may blacklist crude humor or blood but allow violence etc.

[vltsna]

Well, at least now we have this:

[2jammers]

a pin is very easy to crack eventually, similar to pass guessing
it’s also very weak by a security standpoint, and most features already require a proper authentication app instead of the pin. the only place the pin is used is when changing parental control related settings, and those pose almost 0 security risk.

[TimeFrenzied (of Xyaery)]

We don’t need to go to a website and solve a captcha to open our phones lol

[2jammers]

the reason a 4-6 number passcode is used on phones is because you can’t even attempt to bruteforce unless you have the phone physically

[TimeFrenzied (of Xyaery)]

True. I was pretty much making a very simplified argument to explain why we should have at least the option to use a pin. Probably falls flat in a non simple subject.

[metatablecatmaid (metatablecat)]

You physically need the phone, also most modern phones will lock themselves down if they detect bruteforcing.

[abidbmt]

Ah ok if Roblox now asks you for 2FA when changing passwords its fine, it didnt used to require 2FA before.

[abidbmt]

Yes please require 2FA for any purchases, my account has been hacked before and the hacker spent all my robux on items which required me to revert my inventory… This is annoying because now if i ever get hacked again and i need an inventory revert, the request is going to get denied…

[thevalleyofashes (Ashes)]

Good updates for parents who actually care, eventhough I know roblox is international and majority of non english speaking player’s parents don’t even speak English to understand this. But have you at least fixed or changed the thing that anyone who gets the player’s cookie can easily access their profile yet? Removing the PIN without fixing those issues would just make anyone who accidentally clicks on a logger link unable to stop the logger from entering their account. Almost everyone who plays roblox uses PIN for security reasons and not because their parents understand how that works so I hope you all reconsider that.

[GazilionGrandGadgets (Gaz)]

Website / app chat outside of experiences was beneficial during the pandemic, but I honestly think it’s better if it remains available with parental consent, and the ability for parents to monitor chat at any time.

I started Roblox when I was 11 and did not use Discord as an alternative until I was 16, so being able to chat on the website / app while under 13 was very convenient for my friends and I to spend more time together, but unfortunately, creeps out there decided to ruin it with their disgusting behavior. No matter how hard the filter tried, I’ve seen stories about them able to convince their “friends” to switch to Discord or something else, and many parents didn’t know about it.