the account pin is completely useless lol; if you know anything about pass guessing you would know a macro could guess one of the combos in just a few seconds
If you knew anything about web security you might know there is a limit of how many guesses you have. Out of 10k combinations, having 3 tries before its locked isnt very helpful
1 Like
Im confused, what will happen to accounts that already have pins?
1 Like
haha good one, there’s plenty of ways to get around that
No, there really isnt since its not client sided but you can wait it out and take multiple months to keep guessing the pin.
2 Likes
For me, the display name is the only important thing here that isn’t protected for some reason. Since this is treated as a secondary username on Roblox nowadays, it seems weird that it isn’t
The approach I was hoping for is similar to the current system where if you try to make a change, it asks for the account pin then unlocks the account setting page for 5 minutes.
It would basically be this but instead of a pin, it would ask you for your authenticator code (or email), then unlock the page for 5 minutes.
1 Like
I have an old account of mine that I made when I was really young, and being influenced by Roblox YTers of that time to set an account pin, I entered some random numbers without any extra thought that I might need to write them down or even remember it for later. Now, almost a decade later, I found my old password thanks to my parents, but I can’t actually reset anything or even change my bio because of this mysterious pin lock.
I support the removal of self assigned account PINs. Situations like these can’t really be solved otherwise, unless I’m wrong
1 Like
removing the pin is a terrible idea when schemes such as cookie logging are rampant and can bypass 2FA without issue…
3 Likes
Players are using parental pins to protect their accounts from bad actors.
If a cookie is stolen, or they have a system virus, or whatever it may be, two factor won’t work in it’s current state. I don’t appreciate you ignoring 99% of the post.
Players want to lock down changing any account settings behind an additional prompt, this protects the player from even session token stealing.
Introduce this new system: When a player wishes to change their account settings, it first requests a second factor, such as a code from email, or a code from an authenticator app, or a security key. Once approved, the player may change settings as they desire. Additional security: If the action fails numerous times, log the user out and send an email.
1 Like
I’m kinda confused, is this not the case already? I tried to change my email just now and got prompted to enter a 2FA code, same with the password. Although it is kinda confusing how it doesn’t prompt it immediately
1 Like
I think one of the best ways you could repurpose the pin rather than remove it altogether, is instead of locking people from doing things such as changing settings, lock them from purchasing items, because lets imagine a situation where a high value profile gets hacked, and the hacker, although not able to completely steal the account due to 2fa, theyre able to steal robux from it by forcing the account to buy assets that takes all of its robux, like if the account had 2 million robux, the hacker could create a gamepass costing 2 million, and make the victim buy the asset, allowing the hacker to steal the robux easily, but this could be completely stopped by a system where when you want to purchase an item, no matter what it is, even if its free, it requires pin authentication, and once authenticated, unlock the pin for 5 minutes like the system it is now.
(I say to include even when its free, because i can imagine a situation where the hacker might want to completely sabotage the account, so they might, for example, publish an NSFW asset to the marketplace, force the victims account to buy it and republish it under their account, and falsely get them terminated for it, which ive seen happen before with “crosswoods” games)
Thats all just my opinion though because I’ve seen various posts on social media where people got hacked and the hackers stole their robux by making their accounts purchase items made by the hackers with the intent to steal the robux.
1 Like
To also add on this, I think the same should be done for when a user wants to delete any item from their inventory, ive also seen situations where hackers threaten their victims, by saying theyll delete their gamepasses, badges, etc.
I’m suprised these weren’t features already in parental controls to begin with given how many gaming/technology companies implement systems to prevent children from buying things unintentionally or without permission first.
Removing this feature is a awful idea, and there’s really no reason to remove it at all. The account pin has saved many of my friend’s accounts before, I believe it should stay as a feature or get reworked instead. Saying to turn on 2FA isn’t sufficient, if you get cookie logged, it will now just be game over for you.
2 Likes
Personally a 2FA check for sensitive settings (username, display name, email, password, passkeys, etc.) being changed would be great but in addition to that potential support to use passkeys instead of 2FA of these things as an option to pick between.
Not having anything to secure this type of data in event of potential compromise is a bad idea personally.
I don’t get why they’re removing the PIN to begin with. With all the mess that’s been going around not so long ago, you’d think they’d add a new security feature, not replace it with an arguably worse one. Why not just have both?
I had my session stolen about a year ago. I had trading disabled, but without a PIN. They just turned it back on, moved all my items to some other account and Roblox somehow thinks there is nothing suspicious about the 10 1000 robux worth of items for crazy glasses deals (which is why my avatar is like this now). Nobody steals passwords these days because those that don’t have 2FA often have nothing worth stealing.
Presumably account session protection has been enabled given that the timeline for it being released has already elapsed so cookie theft shouldn’t really be a main concern the majority of the most vulnerable endpoints (like changing passwords, sending trades or changing the main account settings); the main vulnerability that I’m aware of here would be if someone already has access to run code on your device and can bypass account session protection in-which at that point, I think you may have bigger worries to think about. 
Of course, there are many endpoints that are covered by PIN but not session protection, but many of these require other security verification methods (like 2FA). Again, I do wish to re-iterate that having a PIN-like 2FA prompt would improve security regardless of the above fact and assuming that the PIN feature is made more secure (like my aforementioned suggestion), it should be restored as a feature.
That still doesn’t cover the fact that they can’t do much without a PIN or a password. At worst they can steal my 100 abandoned projects, or the 100GB black hole that’s the Download folder.
Account pin can be removed by emailing Roblox Support
1 Like
Agree this update is terrible, instead of removing it how about you simply move it to the security tab, what’s wrong with PIN + 2SV? Also maybe allow for an optional amount of digits, or at least 4 as a minimum.
I see absolutely no benefit in removing this.
EDIT: You should also take into account people who don’t have phones and don’t want to provide email addresses, I know many privacy cautious people who aren’t comfortable with providing Roblox (Or any other big corporation) with that information, and fair enough.
4 Likes
2step is a braindead solution to this
just add like a bios password but for settings
1 Like