These forums have been archived and are now read-only.

The new forums are live and can be found at https://forums.eveonline.com/

EVE General Discussion

 
  • Topic is locked indefinitely.
 

A question regarding the privacy of EVE-mail.

First post
Author
Previous Topic Next Topic
SilentAsTheGrave
Aliastra
Gallente Federation
#61 - 2015-02-14 21:56:21 UTC  |  Edited by: SilentAsTheGrave
What I find perplexing is this:


  • It is stated that becoming part of a group from the start is critical to enjoying the game.
  • To join any group that is recommended, requires that I hand over my full API.
  • This now allows these strangers to read every correspondence I have, see my every transaction, literally everything I do.
  • Given the reputation of the game to not trust anyone, it puts me and I assume many new players, into an awkward position.


I understand EVE did not always have the full API and players joined corporations just fine. Players had some form of privacy to correspond with other players without their corporation knowing everything down to the last cent of ISK they made. Now the standard it seems is you have to give up everything to join a group.

Everyone is so passionate about me giving them my API so they can know every move I make and in the same breath telling me I have nothing to worry about. I ask them to give me their full API and they act like I'm crazy.

My point is it just makes me a bit paranoid as well as other players to want to join a group. And if we are not joining a group, one of the key things needed to happen to stick with the game, we are more likely to stay in our non group corporation. Or just quit the game.

Rookie channel doesn't seem to help very much as they just keep insisting to give away my full API and not be concerned. I think my private mails no longer being private is a concern. They said if I don't hand over the API key it means I am a spy, yet I just started. lol

I was told the learning curve for EVE is steep, but it feels like it is the players over complicating things that is the problem.
shimiku
Zircron Industries
#62 - 2015-02-14 22:01:43 UTC
Indahmawar Fazmarai wrote:
Memphis Baas wrote:
Just like with real emails, they're possibly readable by a slew of routers that the message passes through, and by the NSA, and your recipient friend has a permanent copy and can fully post all your private info and photos on the internets for everyone to see.

So, do not send private information through the in-game email.

If you have, already, delete it, and ask your friend to delete it. He/she probably will, if they're your friend.

And if they don't, a bunch of recruiters and directors, who are probably so swamped by join requests and corporate drama issues that they don't even have time to eat, may see your in-game mail and disregard it. They're typically looking for signs that you're a spy, corp thief, or awoxer, really, and probably won't even care to read whatever private info you've disclosed.


Maybe we're losing focus here.

What bothers me is not that "my" API gives "my" information but that "their" API will give out "my" information too, and I have not been warned of that before using the evemail service.


i dont want to be a **** here but if a full API reads all of your mails what did you think they did on other ppl API dont read your mail or what ? or did you think it only grap out going mails ?
Jimmy Farrere
University of Caille
Gallente Federation
#63 - 2015-02-14 22:43:01 UTC
I think the issue here is that players who have no interest or experience with the API system are being exposed to this without explicit warning of what is actually being risked.

Sure, most everyone will understand that if you send someone an Eve-mail they may then choose to forward that email on to other people. But what isn't so obvious is that simply by sending an Eve-mail to a player that communication is automatically and quite invisibly being exposed to anyone who that person has registered a full API with (at that time or in the future).

To me the T&C's and EULA just read like standard corporate ass-covering waffle of 'we will not be held accountable for in game communications' blah de blah and not DO NOT USE EVE-MAILS FOR ANYTHING as anything you send is easily and legitimately circulated amongst the rest of the player base via the API system.

There really should be a warning/disclaimer right on the top of the Eve-mail window explicitly stating what the situation is. You can't even find this information in game, and not even out of game without understanding the API system and reading between the lines of a massive document.
Serene Repose
#64 - 2015-02-14 23:37:46 UTC  |  Edited by: Serene Repose
Godfrey Silvarna wrote:
Pok Nibin wrote:
even though they live in a state that protects their right to privacy in their letters and other communication, which includes criminal penalties if violated (fines and prison time), that they can come here and create a system that not only entirely disregards my right to this, does this while I'm paying them money, and then blames me should anything untoward occur.

I am fairly certain that the law in Iceland does not protect you or CCP from the risk that anyone you or CCP sends mail to, electronic or physical, might publish your mutual communications.
Misconstrue...lead, or just miss the point much?

If YOU go into my Icelandic mailbox, and retrieve a letter sent to me by Pok, I'll bet the Icelandic authorities wouldn't just continue munching donuts given that tidbit of information. Should YOU put a listening device on MY phone, a dime'll get you a dollar if the Icelandic FUZZ don't show you a new set of bracelets.

I love it when people are profoundly ignorant, don't you? Oh, wait. Your post was supposed to be a slam dunk! Sowwy P

We must accommodate the idiocracy.
Godfrey Silvarna
Arctic Light Inc.
Arctic Light
#65 - 2015-02-14 23:45:35 UTC  |  Edited by: Godfrey Silvarna
Serene Repose wrote:
Godfrey Silvarna wrote:
Pok Nibin wrote:
even though they live in a state that protects their right to privacy in their letters and other communication, which includes criminal penalties if violated (fines and prison time), that they can come here and create a system that not only entirely disregards my right to this, does this while I'm paying them money, and then blames me should anything untoward occur.

I am fairly certain that the law in Iceland does not protect you or CCP from the risk that anyone you or CCP sends mail to, electronic or physical, might publish your mutual communications.
Misconstrue...lead, or just miss the point much?

If YOU go into my Icelandic mailbox, and retrieve a letter sent to me by Pok, I'll bet the Icelandic authorities wouldn't just continue munching donuts given that tidbit of information. Should YOU put a listening device on MY phone, a dime'll get you a dollar if the Icelandic FUZZ don't show you a new set of bracelets.

I love it when people are profoundly ignorant, don't you? Oh, wait. Your post was supposed to be a slam dunk! Sowwy P

None of what you said have anything to do with the API. CEO's and recruiters don't crack other people's accounts to steal evemail. They are voluntarily given API keys by players who CHOOSE to share their private communications. None of this is illegal or suspicious from an outside perspective. It is entirely up to the player who shares his mailbox to figure out if they should do it or not. Any loss of trust or other consequences are also their private business if some of their correspondents disapprove of this.
Aiwha
School of Applied Knowledge
Caldari State
#66 - 2015-02-14 23:57:51 UTC
SilentAsTheGrave wrote:
What I find perplexing is this:


  • It is stated that becoming part of a group from the start is critical to enjoying the game.
  • To join any group that is recommended, requires that I hand over my full API.
  • This now allows these strangers to read every correspondence I have, see my every transaction, literally everything I do.
  • Given the reputation of the game to not trust anyone, it puts me and I assume many new players, into an awkward position.


I understand EVE did not always have the full API and players joined corporations just fine. Players had some form of privacy to correspond with other players without their corporation knowing everything down to the last cent of ISK they made. Now the standard it seems is you have to give up everything to join a group.

Everyone is so passionate about me giving them my API so they can know every move I make and in the same breath telling me I have nothing to worry about. I ask them to give me their full API and they act like I'm crazy.

My point is it just makes me a bit paranoid as well as other players to want to join a group. And if we are not joining a group, one of the key things needed to happen to stick with the game, we are more likely to stay in our non group corporation. Or just quit the game.

Rookie channel doesn't seem to help very much as they just keep insisting to give away my full API and not be concerned. I think my private mails no longer being private is a concern. They said if I don't hand over the API key it means I am a spy, yet I just started. lol

I was told the learning curve for EVE is steep, but it feels like it is the players over complicating things that is the problem.




EVE has had API for a decade now. It used to be you had two API keys, a limited API key which told **** all, and a full API key that had naked photos of your character. Now we have these awesome customization API keys that let you choose access levels.


Everybody wants a full API key because nobody trusts random strangers. You're the one approaching them, you're the one who needs to make the concession to build trust.

Sanity is fun leaving the body.
Vyl Vit
#67 - 2015-02-15 00:19:20 UTC  |  Edited by: Vyl Vit
Godfrey Silvarna wrote:
Serene Repose wrote:
Godfrey Silvarna wrote:
Pok Nibin wrote:
even though they live in a state that protects their right to privacy in their letters and other communication, which includes criminal penalties if violated (fines and prison time), that they can come here and create a system that not only entirely disregards my right to this, does this while I'm paying them money, and then blames me should anything untoward occur.

I am fairly certain that the law in Iceland does not protect you or CCP from the risk that anyone you or CCP sends mail to, electronic or physical, might publish your mutual communications.
Misconstrue...lead, or just miss the point much?

If YOU go into my Icelandic mailbox, and retrieve a letter sent to me by Pok, I'll bet the Icelandic authorities wouldn't just continue munching donuts given that tidbit of information. Should YOU put a listening device on MY phone, a dime'll get you a dollar if the Icelandic FUZZ don't show you a new set of bracelets.

I love it when people are profoundly ignorant, don't you? Oh, wait. Your post was supposed to be a slam dunk! Sowwy P

None of what you said have anything to do with the API. CEO's and recruiters don't crack other people's accounts to steal evemail. They are voluntarily given API keys by players who CHOOSE to share their private communications. None of this is illegal or suspicious from an outside perspective. It is entirely up to the player who shares his mailbox to figure out if they should do it or not. Any loss of trust or other consequences are also their private business if some of their correspondents disapprove of this.
You make a good apologist. However, you answer none of the issues raised. You just make excuses and blame shift. A lot of text for that, too. You also missed the original point. Maybe if you reread you can catch up.

Paradise is like where you are right now, only much, much better.
Elenahina
Federal Navy Academy
Gallente Federation
#68 - 2015-02-15 00:47:08 UTC
SilentAsTheGrave wrote:


  • It is stated that becoming part of a group from the start is critical to enjoying the game.
  • To join any group that is recommended, requires that I hand over my full API.
  • This now allows these strangers to read every correspondence I have, see my every transaction, literally everything I do.
  • Given the reputation of the game to not trust anyone, it puts me and I assume many new players, into an awkward position.


I understand EVE did not always have the full API and players joined corporations just fine.


That second bullet point is wrong. You don't HAVE to give out your API to anyone, and frankly, that isn't what the OP is complaining about.

Not that the OP's complaint is an actual problem, or in any way surprising to anyone that bothers to think all the way through the process.

Eve is like an addiction; you can't quit it until it quits you. Also, iderno
Elenahina
Federal Navy Academy
Gallente Federation
#69 - 2015-02-15 00:50:47 UTC
Godfrey Silvarna wrote:


If YOU go into my Icelandic mailbox, and retrieve a letter sent to me by Pok, I'll bet the Icelandic authorities wouldn't just continue munching donuts given that tidbit of information. Should YOU put a listening device on MY phone, a dime'll get you a dollar if the Icelandic FUZZ don't show you a new set of bracelets.


There is a significant difference between me illegally wiretapping your phone, and you telling me it's ok to put the wiretap in there for a week, and at the end of that week, you can take it out and throw it away.

What people keep missing is that you are choosing to use this system without understanding the implications of that use. That is YOUR problem, not ours, and not CCP's.

Eve is like an addiction; you can't quit it until it quits you. Also, iderno
Sir Substance
Sebiestor Tribe
Minmatar Republic
#70 - 2015-02-15 01:30:42 UTC
Malcanis wrote:

I don't know what else you thought full API meant? TBH this is pretty common knowledge, and given that GMs can also read your evemails, I can't think why anyone would ever put anything personal into one.

I donno man, with 7.5 years in this game that never occurred to me. Now you mention it, I'm not surprised in the least, but it's one of those things that has to cross your mind before you consider it, and until now it hadn't crossed my mind.

I do feel like it's something that should have an explicit warning on the API creation page. Maybe a discreet tag under api keys that give access to mail saying "caution: anyone with this key can read your evemail"?

The beatings will continue until posting improves. -Magnus Cortex

Official Eve Online changelist: Togglable PvP. - Jordanna Bauer
Kestrix
The Whispering
#71 - 2015-02-15 01:58:44 UTC
This is why I delete all mails before giving my API key to anyone... also after they have had your API key and had their look change it.
Benny Ohu
Royal Amarr Institute
Amarr Empire
#72 - 2015-02-15 03:37:14 UTC
CCP Falcon wrote:
Hope this explains things.

it does, but i feel there's something missed

i don't entirely blame someone who doesn't read through the eula and tos. they're long and boring and can be hard to comprehend. on the face of it, if one didn't know about the api, evemail looks private. i imagine everyone's aware that the addressee might share the mail, but the api isn't an everyday thing joe average'll be aware of when they join the game

while it's mostly their personal fault, i feel it's understandable for a person to make the mistake of believing evemail is reasonably secure. i wonder how many are under this impression?
SilentAsTheGrave
Aliastra
Gallente Federation
#73 - 2015-02-15 04:01:27 UTC  |  Edited by: SilentAsTheGrave
Elenahina wrote:
SilentAsTheGrave wrote:


  • It is stated that becoming part of a group from the start is critical to enjoying the game.
  • To join any group that is recommended, requires that I hand over my full API.
  • This now allows these strangers to read every correspondence I have, see my every transaction, literally everything I do.
  • Given the reputation of the game to not trust anyone, it puts me and I assume many new players, into an awkward position.


I understand EVE did not always have the full API and players joined corporations just fine.


That second bullet point is wrong. You don't HAVE to give out your API to anyone, and frankly, that isn't what the OP is complaining about.

Not that the OP's complaint is an actual problem, or in any way surprising to anyone that bothers to think all the way through the process.

I still stand by my point, even if it is not precisely what this thread is about. It is repeated over and over that to enjoy the game, one must join a corporation. Even further one should look to join a corporation that is not in high security space. The catch is ever where I have turned to ask about these groups that I have read about - ALL demand a full API. I ask why and I am immediately accused of being a spy and to stop bitching and hand it over to prove them wrong.

So you see, it is required. Unless of course I want to just hang out in secure space grinding missions and most likely become bored. Everyone is saying handing over your full API is nothing to worry about and no big deal, but I can't help but ask questions on why such a 'non-important thing' is so critical for a corporation to be able to function. I've already handed over my full API due to massive peer pressure and the fact I want to actually start enjoying the game. Ironically now I am being told it will be three to four days to 'process' the information.

So now I have to twiddle my thumbs trying to entertain myself with proclaimed 'un-fun activities because I'm not in a corporation with other players' for days. All because everyone is super paranoid over me being a spy, traitor or something equally sinister.

I just want to log in and play. Is that so bad?
Theodoric Darkwind
The Scope
Gallente Federation
#74 - 2015-02-15 05:15:14 UTC
Indahmawar Fazmarai wrote:


Maybe we're losing focus here.

What bothers me is not that "my" API gives "my" information but that "their" API will give out "my" information too, and I have not been warned of that before using the evemail service.


It's no different than sending personal information to somebody's work email, you always assume the sysadmins can and will read it.

Full APIs are a standard practice in most larger corps (and nearly all corps that operate outside of highsec). You should also assume that any RL info you put into an evemail will get googled by alliance recruiters and intel people. I ran HR for my previous corp for about a year. I caught several spais because of info they let slip in EVE-mails, some of that was even non-EVE related, I caught one spai because he let his steam ID slip in an EVEmail and I found that his steam ID was associated with a steam group belonging to a hostile alliance.
Candi LeMew
Division 13
#75 - 2015-02-15 06:25:40 UTC
So devil's advocate - Why do we even need mail API?

Can someone tell me the big positive it gives that makes it so necessary in EVE where 99% of other similar entities would never dream of allowing such a thing?

Why don't we just get rid of mail API?

🍌

Remember... in Anoikis Bob Is Always Watching...

"I been kicked out of better homes than this" - Rick James
Serene Repose
#76 - 2015-02-15 06:28:35 UTC
Better idea. Don't join corps that expect a full API. Get rid of CEOs that think it's a good idea. Derp.
All successful spais will tell you, it is so easy to beat, it's a joy to know a CEO is actually using it to catch them.

We must accommodate the idiocracy.
Alavaria Fera
GoonWaffe
#77 - 2015-02-15 06:35:01 UTC
Theodoric Darkwind wrote:
Indahmawar Fazmarai wrote:


Maybe we're losing focus here.

What bothers me is not that "my" API gives "my" information but that "their" API will give out "my" information too, and I have not been warned of that before using the evemail service.


It's no different than sending personal information to somebody's work email, you always assume the sysadmins can and will read it.

Full APIs are a standard practice in most larger corps (and nearly all corps that operate outside of highsec). You should also assume that any RL info you put into an evemail will get googled by alliance recruiters and intel people. I ran HR for my previous corp for about a year. I caught several spais because of info they let slip in EVE-mails, some of that was even non-EVE related, I caught one spai because he let his steam ID slip in an EVEmail and I found that his steam ID was associated with a steam group belonging to a hostile alliance.

Are you working for our internal security group now?

The heroes we deserveneed

Triggered by: Wars of Sovless Agression, Bending the Knee, Twisting the Knife, Eating Sov Wheaties, Bombless Bombers, Fizzlesov, Interceptor Fleets, Running Away, GhostTime Vuln, Renters, Bombs, Bubbles ?
Indahmawar Fazmarai
#78 - 2015-02-15 08:34:33 UTC  |  Edited by: Indahmawar Fazmarai
Candi LeMew wrote:
So devil's advocate - Why do we even need mail API?

Can someone tell me the big positive it gives that makes it so necessary in EVE where 99% of other similar entities would never dream of allowing such a thing?

Why don't we just get rid of mail API?



That's one interesting question, with a interesting answer: checking mails as a way to check for incompetent spies is necessary because CCP's corporation system is so incredibly shoddy that a single spy can dismantle a whole alliance and destroy irreversibly the work of thousands of people by clicking a single button.

So CCP's bad corporation system leads to bad email API and players handing out on a regular basis information which is not of their property and does not matter to the persons receiving it.

CCP tells me that I should not entrust evemail with personal information because they aren't legally responsible of that, but the point with communication services is to communicate and everyone and their father have certain expectations on mailing systems. Can a mail be copypasted or forwarded? Yes. Is it usual that people getting your mails are requested to share your mail to third persons if the addressees want as much as play a videogame "in the right way"? Hell, no!

If, say, someone used evemail to aks for advice, or help, in a RL distressin situation, I would be forced to turn that person down if I as much as suspected that said person would give a full API with my answers to his evemails to a series of potential recruiters...

"Sorry dude, this is EVE and even as I'd like to assist you, I can't because doing so could lead, potentially, to half of New Eden reading my answers if you as much as handed a full API to your next recruiter. Just take my word for it, as you can't look for that in the non-existant user manual of EVE; also you can deduce it yourself by looking at the EULA, the ToS, CCP's privacy policy and the evepedia article on API keys. Or just ask to other players to know in how many ways you're stupid to not know that just by subscribing."
SilentAsTheGrave
Aliastra
Gallente Federation
#79 - 2015-02-15 10:20:16 UTC
My personal favorite so far is one recruiter being able to deduce what subscription model I picked after seeing my transaction history and the clothing and cyber arms I received. I didn't buy them off the market. Call me paranoid, but I just feel like this whole API requirement as the bar to get into a group is, well... a bit too far. Groups were able to recruit players and grow before full API was a thing and now, standard practice for almost all non-high sec.

The question I keep asking is; does the existence of the full API cause more harm than good? Instead of being able to join a corporation, I now have to wait days and days for the groups to run their API parsing 3rd party programs and going over every scrap of data. Why? To keep out day tripping spies. Meanwhile any spy who puts forth the slightest effort is still able to infiltrate and do their spy thing.

The first few days playing a new game is pretty critical in hooking the player. For EVE, you spend those first few days in a waiting room.

I think this is all I will say on the matter. Far too many people have expressed anger towards me because I think this whole full API to join a corporation is self destructive. P
Godfrey Silvarna
Arctic Light Inc.
Arctic Light
#80 - 2015-02-15 10:32:47 UTC  |  Edited by: Godfrey Silvarna
Candi LeMew wrote:
So devil's advocate - Why do we even need mail API?

Can someone tell me the big positive it gives that makes it so necessary in EVE where 99% of other similar entities would never dream of allowing such a thing?

Why don't we just get rid of mail API?


The Mail and other parts of API are incredibly useful for a lot of things. For example, if you want to make a mobile app that monitors your evemail inbox and notifies you of an incoming message, you need a mail API to make it work. I find it amazing that CCP provides us with such powerful tools for making third party applications that tie into their game.

Don't blame the tools, blame the users.