This is a pretty huge oversight. Relevant to these two instances of account hacking (Thread 1, thread 2) - The hacker, once he’s gained access to an account, links his Facebook account to the stolen Roblox account. This way, even after the original account owner regains access and changes his password(s), the hacker can just click the “login with Facebook” button to get back into the account without needing its current password.
I just linked my own Facebook account to my Roblox account to test, and there seems to be no indication on Roblox that there’s a Facebook linked to my account, and no way to remove the Facebook link via Roblox. If your account gets compromised, the hacker can use this backdoor to get back into your account whenever they’d like, and you have no way to remove it or even know if a Facebook is linked to your Roblox account (aside from probably contacting Roblox support).
This needs to be fixed ASAP. There needs to be a spot on the account settings page to manage linked Facebook account(s), and there needs to be an email notification sent if a Facebook account has been linked. Changing your Roblox password/signing out of all sessions should also unlink any Facebook accounts. This is a terrible vulnerability/oversight that’s being taken advantage of to secure stolen items for good (as the victim will have already used his one-time account restoration).
Also, I really hope 2 step authentication is a top priority at this point
Should we be linking our Roblox accounts to our own Facebook accounts now to prevent some account hacker from linking the account with their own Facebook?
I would assume that doesn’t work.
I’ve been talking to Devin (the most recent victim). He was just able to link his own FB to his account after regaining access, even though Alex (the hacker) is already known to use this method.[quote=“ScriptOn, post:4, topic:22190, full:true”]
Also can more than one account be linked?
[/quote]
I don’t know if multiple accounts can be linked, or if linking a new FB account will remove the previous link. I only have my one FB account to test with.
If your account gets compromised, you could still probably get Roblox support to check for and remove any linked Facebook accounts. That’s the advice I gave Devin. But yeah, this is a pretty bad oversight that needs to be addressed before it becomes even more widespread.
It would be interesting if we could also get a way to prevent linking of accounts via email confirmation. Reason is I don’t own a Facebook account, and isn’t in my plan book to do so.
Glad to hear there’s a way, but I’d like a way to do it myself. Although I’m very confident in my account’s security, I want an option to force unlink in case of a situation like this occurs. No reason to not have such feature.
I would honestly like to unlink my Facebook account from my Roblox account.
I had to change its automatic posts to “Me Only” because I thought it was extremely goofy that it would say “I’m playing a free game on Roblox” with a game link on my behalf.
That’s why I unliked my Facebook after I connected it when it just came out.
Later on I discovered those settings.
I think my FB account auto-unlinked after I didn’t login with it since some time.
Also, I’m pretty sure you can unlink it from the Facebook settings, as @kirkyturky12 mentioned.
IIRC, it’s somewhere in your settings under Apps, where you can unlink your account from apps.