Tighten up account security by re-adding and modifying security PIN codes

Feature Requests Website Features
1

As a Roblox developer, it is currently too hard to stay secure.

Consider a user who has 2-step verification or the authenticator app (Which are the only options roblox gives you other than hardware keys). This is great to keep your account secure, but people can easily get their account compromised just from clicking the wrong link unintentionally. The risk is even higher if you’re a more successful developer, as you become a bigger target of hijacking.

The hijacker inside your account would easily be able to bypass any 2 step or authenticator app prompts from there on when changing account information. However, roblox used to have an extra layer of security which was simple and effective.

4-digit security PIN codes. Which prevented anyone on your account from changing crucial information if they had access to your account. Such as your password.

These are now only available for use if your account is below the age of 13. Which is awful.

These weren’t just a parental feature, they were very strong security measures. Even known as 3 step verifcation. These were crucial for developers, especially ones with millions or billions of robux.

PIN codes need to be brought back to tighten up account security. However, I wouldn’t want them to behave exactly how they did before. If I remember correctly, Security PIN codes were only active inside of account settings (eg password changes). While this is a very good feature and should stay as one if PIN codes were brought back, pin codes can be used for so much more. Adding letters instead of just numbers also decreases the chance of cracking the code via guessing.

Speaking of passcode guessing. Hackers can do this via a bot. So, it would be best for their to be an automatic lock after a certain amount of tries. And the account user can find when and where a login to the account has happened and from there deactivate their account temporarily for safety, they can then contact Roblox support and take things from there.

If a hijacker has entered a developer’s account which has millions of robux, they’re either going to try and waste all their robux, devex from the developer’s account with a new devex portal account, or if the developer is an owner of a popular group with millions of group funds they will try and use group payouts to send robux to the hijacker’s account.

All of this CAN be prevented with security PIN codes, when doing anything related to devex, purchasing anything with robux, or group management (eg group payouts). There should be a required 2-step/authenticator app verification process AND security pin codes on top of that.

If Roblox is able to address this issue, it would improve my development experience because these extra layers of protection would prevent any further damage if an account is hijacked. Keeping the account as secure as possible, developers who have worked hard to earn will be safer.

6 Likes
3

When changing account details Roblox actually asks you to input your authentication code to confirm, (or an email code) how would they bypass this?

Once again, most of this still needs authentication codes to even do in the first place, such as group funds, or trading, or changing DevEx info.

I’m not opposed to this feature coming back as I do agree it was a good security measure to have, however, I’m not understanding the examples that are being provided and I feel like maybe this could be explained a bit more in depth?

4

Sorry if I didn’t explain clearly enough, I meant. If they already got you to click a link, and they alraedy have access to your authenticator/email. They would bypass all of it. Which is not very uncommon nowadays.

They already have the 2 step/authentication app to check for these. I just said that to explain clearly that it would be best if they had all the current security measures on them including the pin codes.

5

Thanks for the clarification, I thought this was more or less operating on the basis of Roblox Database leaks which could lead to being compromised and rather not being phished via a scam link, as I get plenty of random people emailing me trying to buy my account or to scam me.

image
image1737×175 17 KB

3 Likes
6

This is a thing of the past. Clicking on a link won’t give them direct access. Neither would fishing give them direct access given the 2FA.

You gotta stop spreading misinformation bro.

—-

The only way to bypass the pin is to brute force it or phish for the pin from the victim but unless you’re really rich and the attacker is good at social engineering then this is unlikely.

7

https://www.scworld.com/news/tycoon-2fa-phishing-kit-update-timeline-reveals-new-evasion-techniques

People are able to bypass 2FA on companies like Microsoft that have much stronger security I’d be surprised if Roblox with its smaller budget doesn’t have the same problem.

There are countless recent anecdotes of accounts being hijacked despite having 2FA in place. Whether it be from a suspicious link or whatever.

And besides all that, Roblox has millions of developers with millions of Robux. Having more security options in place. Especially simple yet effective ones, should be a priority.

8

According to that very article you link though it explicitly states that they obtain the 2FA via the fake login page. They aren’t “bypassing” anything and are just baiting the user into mistakenly entering all of the required login details.

Meaning this is only a concern in the brief period of time while that 2FA code hasn’t rolled over, at which point there are much better ways to address that flaw than to needlessly reintroduce pins (this gets easily defeated by something as something as temporarily preventing sensitive or dangerous actions being performed immediately after the session was created).

1 Like
9

Have you borthered to read the article your self?

Also as someone who does CS (Cyber security) please stop saying theyre bypassing it. There is no way to “bypass” 2FA unless its through a vuln within the target companies backend or if the victim is phished like in the article your sent.

Stop saying bypassed. It makes me cringe.

Its literally the customers fault if the attacker gets around the victims 2FA.

There are only one way to prevent 2FA attacks and that is a hardware key. There are multiple methods of 2FA including auth app, sms or email.

If you get either of those compromised then its YOUR fault not robloxs therefore you should take better care with account security.

Maybe just by a hardware key.

1 Like
13

Yeah ATLEAST you’re admitting it… big change :roll_eyes:

Even if there are banking security measures in place PIN codes being a simple yet effective security measure adds an extra layer of protection. It doesn’t hurt to have it now does it?

And what do you mean no need to be rude? If you’re gonna be a bum atleast be able to throw AND handle jabs. You expect to be rude and don’t expect someone to be rude back? That’s pathetic and the equivalent of the thought process of a 10 year old.

And do what a lot? I’ve only made 2 feature requests, which were completely valid ones to make.

15

I sincerely doubt somebody is going to guess all 9999 possible combinations for an account pin!

4 Likes
16

Okay, a hypothetical. If someone gains access to your account via cookie logging or otherwise, and realizes “oh man this person has a PIN set up”, they can decide to not do anything suspicious and silently guess every possible PIN combination using an extremely naive bot that just guesses all combinations in a row. On average, and assuming a relatively slow rate of 1 guess per minute, they’ll crack it in 3.5 days, given that PINs are just 4 numbers. Think of how long an attacker would be willing to wait for a successful account break-in, and the subsequent payout of how much Robux the account has… probably a lot more than 3 days.

That’s not going to happen with a Yubikey (they’d have to break into your house) nor a 2FA (they’d have to gain access to your phone), and if either of those are broken, you have a far worse problem. PIN is genuinely not secure enough to be considered viable IMO, and this feature request is structured in a way where it’d be a necessary factor for MFA. So surely you can understand why I wouldn’t want this.

17

They’d just get locked out, when account pins were still around, you only had a couple of attempts. So I’m not really sure why we’re discussing about hypotheticals!

5 Likes
18

Did you read the part of my message where I said even if there were only one guess per minute, it’d still be found in 3 and a half days? Even if they extended it to 15 minutes (which certainly isn’t going to trip this “lockout”), your account would still get broken into after 50 days or so.

The point is that, given enough time or luck, it is not secure enough to keep someone determined out. It is still guessable within a reasonable time period. That’s not secure.

19

Yes, which doesn’t matter because when an account gets locked you are forced to contact Roblox support. You cannot re-break into an account after it gets locked. They only stopped doing this recently around early 2024. I don’t really know what you’re not understanding, as what you’re suggesting is so unlikely to even occur in the first place that it comes off as a what-ifism than an actual plausible scenario.

5 Likes
20

Hijacking isn’t 100% preventable. Kids can always be tricked into entering their account information.

But that’s just one way of getting hijacked and it mainly happens to kids. A phishing link is much easier to happen and a much more likely way of getting hijacked.

Sure they can passcode guess with bots, but not only will this take quite a while due to the PIN codes locking feature. Players can easily figure out a hijacker is in their account by checking the log in sessions and from where your account has been logged into. An Australian user seeing a login from the USA is a big red flag for them. They can then deactivate their account and follow up on Roblox support and take it from there.

And you should know your passcode…

21

A better feature request would be to temporarily lock account settings and/or critical actions like the ability to trade/transfer Robux on new sessions. This would give the user enough time to take action once they realize that their account was compromised by some means.