Although I have brought this up in conversation before, considering the impending sunset of user account pins (currently the ONLY layer of defense against a stolen authentication cookie), I feel that it is necessary to post this here now so as to hopefully reduce the risk that we will be facing as a result of this change.
That being said:
As a Roblox user and developer, it is currently too hard to protect our accounts against targeted attacks by malicious actors.
Background Information (âThe Problemâ):
As anyone who has used the platform for an appreciable amount of time is doubtless aware, there has always been a number of malicious actors who target Roblox users with malware, phishing, and social engineering attacks in an effort to gain full access to user accounts.
Such attackers typically act through one of two vectors - either, as is most commonly the case, obtaining the userâs .ROBLOSECURITY cookie through deception and/or malware - or, in some cases, utilizing a Remote-Access Trojan (RAT) or other significantly more damaging malware to gain access to the userâs computer on which their account is logged in.
Upon gaining access to an account through illicit means, attackers typically first take a few particularly damaging actions - starting by changing the userâs email and password to lock the original account owner out of their account. I myself experienced this years ago on my old main account - @GreenKeldeo - and, from that experience, am aware that these changes often completely lock out any way to recover most accounts, even with intervention from Roblox Support.
After removing access to the user account, attackers then go through their assets and permissions - sabotaging groups/experiences, holding them for ransom, and stealing account balances and avatar items to sell via illicit marketplaces. This has long been an issue - and has necessitated a system of poisioning certain items to try to combat these illicit activities.
The Account PIN was, regardless of its original intent, a small way to combat these threat vectors - requiring an additional factor of authentication to modify certain user account settings beyond the main session security token. Unfortunately, it has never been ideal for this purpose, as it was never engineered for it - hence the lack of support for truly secure passcode/passwords for the feature.
With its removal, an open hole is left in its wake - one that should be filled as soon as possible.
Suggested Solutions
Although, for obvious reasons, I will not go into specific implementation recommendations here, I feel that at least an additional full 2-factor check should be imposed on certain âdestructiveâ actions, including (but not limited to):
- Account security settings
- Destructive goup role permissions (e.g. edit access, kick members, change ranks)
- Accept/Deny All functions for legacy group ranks
- Experience deletion
- DevEx Requests
- Transfer Group Ownership
- Item trading
- Studio Log-in (ideally, as an option - especially if itâd allow for a third factor of authentication (i.e. app based 2FA and a passkey) to be checked)
- Changing username/display name
- Accessing the Advertising Portal
- Accessing API keys
- Accessing and/or deleting Secrets
- Deleting a package (ideally, optional)
These checks would not eliminate all risk to user account security from malicious actors, but would buy valuable time for a user to realize what is going on and take corrective action before support intervention is required - and completely protect against basic cookie hijacking. Considering the blood, sweat, and tears we as creators put into the platform, I feel that such checks are sorely necessary to protect our work, our time investments, and avoid unnecessary work for Roblox support staff.
Although I have specific implementation suggestions and recommendations, I will not be posting them publicly out of an abundance of caution. If any staff would like me to provide them, feel free to shoot me a message either here or on Guilded and Iâd be happy to provide my input.