Preventing Session Cookie Stealing on ROBLOX

Feature Requests Website Features
#1

Hi, so I think if we would implement a system like facebook has, would be perfect to prevent cookie stealing on roblox or atleast reduce it in a great amount.

WAY IT WORKS:

  1. User logins into ROBLOX.
  2. IP gets stored in a table.
  3. Website constantly checks that the IP matches to the IP what was used to login.
  4. If it detects a difference then it asks for the user pw to continue.
  5. Profit!

Thanks for listening!

[size=1]~ Luckymaxer is awesome <3[/size]

1 Like
#2

Iā€™d love to see profit achieved on this one! :woohoo:

and cool, your 2nd post :open_mouth:

[size=1]hi moded! yay for tiny print[/size]

#3

Seems fairly straightforward, I wonder why this hasnā€™t been done in the past.

Good idea.

#4

They do not do this because it creates problems for mobile users and users with IPs that change often. They even tried to turn this feature on once but a large enough group of users complained for them to revert it.

#5

Not everyone has a static IP. So yes, this would fix the problem for a large amount of users. But sadly not all :frowning:

#6

This is something weā€™re actively thinking about. As has been pointed out, IP addresses can change and they can also be shared (think all the computers in a computer lab or in a library). Our thinking is that we need to address both scenarios. If you have additional thoughts/suggestions on how to tighten this up, please follow up to the thread.

#7

Uh, dynamic ip at least lasts for quite a while (days-weeks). I mean if we want some extra security then we should ā€˜sacrificeā€™ some of our effort.

EDIT: Oh well, the library is gonna be quite of a problem yeah ;-(

#8

I could be wrong, but Iā€™d think the scenario of a shared IP is fairly rare?

Is there any other hardware/client information the browser can read that could be tracked in this way?
Honestly, Iā€™d be fine with this being some sort of optional feature that requires a chrome extension or something to use.

#9

Fixating on the userā€™s IP doesnā€™t really work for users with static addresses, as has been said many times.

The proper fix for this is to:
[ul]
[li]Enable SSL for all pages and set the SECURE flag on session cookies. This will prevent all sorts of over-the-network session stealing. But this might take extensive engineering effort.[/li]
[li]Provide users with a way to invalidate all sessions. That way if someone does manage to get into your account by social engineering or otherwise, you can kick them out. Preferably there would be a list of valid sessions like Github and other sites do.[/li]
[/ul]

And then for extra credit security allow an opt-in two factor authentication with your phone.

#10

Why not tie the sessions to MAC addresses? MAC addressees donā€™t change (Unless spoofed, which is also possible with IP addresses).

#11

If ROBLOX were simply a game client, that would be a reasonable solution, but itā€™s not. Thereā€™s also the website component which is accessed from browsers, and browsers are not aware of MAC addresses.

#12

Well thereā€™s now a ā€œSign out of all other Sessionsā€ button under account settings. That should help.

#13

[quote] Well thereā€™s now a ā€œSign out of all other Sessionsā€ button under account settings. That should help.

[/quote]

Are you sure thatā€™s not for beta only? I donā€™t see it.

#14

Has to be some Alpha/beta testing on some accounts, i donā€™t have it.

#15

The ā€œSign out of all Sessionsā€ will be enabled for all users shortly. That feature is currently in beta to ensure that we donā€™t accidentally log off all of our users and of course for scaling concerns.

#16

Uh, what if the person who got into your account without permission clicks that button first?

#17

Is this password protected?

#18

Is this password protected?[/quote]

Presuming the user who got in your account knows the password, it would be trivial for this to happen.

I propose that it should send an E-Mail to the account holder with a link to get back into their account in case this happens. Of course, if the E-Mail was stolen too, that wouldnā€™t be useful, but this should at least hold off password guessers.

#19

[quote]
I could be wrong, but Iā€™d think the scenario of a shared IP is fairly rare?

Is there any other hardware/client information the browser can read that could be tracked in this way?
Honestly, Iā€™d be fine with this being some sort of optional feature that requires a chrome extension or something to use. [/quote]

Members that use a VPN might have a shared IP address, as will multiple users at a school for example.

I wonder if the roblox browser plug-in could be modified to retrieve some sort of HWID?

#20

Weā€™re working on other ways to protect your account access, and protect your Inventory/Funds.