EVE Information Portal

A man in the middle attack would require both a signed certificate for login.eveonline.com , and the private key to go with that certificate. No trusted certificate authority would sign a certificate for that website without verifying your identiry.


As to giving third party websites your login info, it does not happen in this system. As I understand it the process works like this:

When you go to the third party website and ask to authenticate yourself, they forward you to CCPs website, which includes enough information for CCP to know what website it was that sent you to their site.

Your Web Browser leaves the Third Party Site, and connects to the login.eveonline.com website. There, if you are not already logged in from some other visit, you can enter your Username and Password. When you login that information goes to CCP and only CCP.

After you login, or if you already logged in on a previous visit to CCPs page (possibly forwarded from another Third Party site, or possibly through some integration with the Ingame Browser authenticating you client), you will get the option to select a character, and you will be asked if you want to let the website access your information. Because each website is required to provide various information to CCP, such as the name and description of the website, and the address, you can verify that there, and it will be listed on CCPs website what information that website can get from CCP. If you reject this, the Third Party Site will not get any information.

If you accept, the login page will send you back to the Third Party Website with a key that that website can use through CREST to access information on your account.


It's actually really handy even though there is only just the Character ID and Character+Account hash, as this can be used in leu of a websites standard login procedure that would require they store a username and password on their site. You are identified by CCP rather than having to identify yourself to the website.

The reasonable concern have is that someone will create a fake Third Party Tool webpage, and pretend to redirect to the login page, and instead redirect to some webpage they control which looks just like CCPs page. They will not be able to make your Web Browser display https://login.eveonline.com/ as their URL. It almost certainly will happen, and it will almost certainly get people hacked, but anyone who is careful enough to not use the same username/password on third party websites as they do for their game account should be careful enough to check the domain name. I think an overall a move to single sign on will be less risky than the alternative where Third Party Sites could have databases containing passwords or password hashes stolen, along with persistent api keys.

PS: A concern I do have is if this is used in desktop or mobile applications, then the application can control things such that it creates even a fake browser, which could easialy trick even computer savvy people who are not looking for such a trick (and if done well enough, even them too). I would propose that a one time use, single sign on only token be creatable on a CCP website, such that you can use that instead of username/password, allowing you to avoid providing full credentials to untrusted applications. I feel this would probably be of little use on web apps however, because anyone savvy enough to use it could get the same protection faster by checking the ssl certificate.

One we really don't care about and the other is a pain in the ass every single day. Wanna guess which is which?

SSO - so gonna be a favorite with hackers...

CCP bringing game mechanics to real life business.
Only CCP would think it was okay to bring such a flawed system to it's customer base.

Glad we cleared that part up; at least you aren't hiding your bias.

Here is my counter Steve. You quoted me but didn't really follow through. My problem is this to your response. Not that CCP hire you full time, but maybe part-time or buy you out for your work with a percentage of profits long term (much like Gates did with MS.) Everyone wins. The tools people like yourself and others provide improve EVE, are brought in game, and most importantly, CCP has an OFFICIAL OBLIGATION like any GOOD (i.e. not lazy or cheap) corporate entity SHOULD do. Corporate ethics (at least in the States) are so bad these days. This just reminds me of sub-contracting in that regard. And when you farm things out to save cash (whether you are okay with it or not) you get sub-par solutions like this. A corporation (like a person - and in the states the Supreme Court ruled corps are people in this regard) has a moral obligation to do things right. CCP operates in the USA. Not to mention, Iceland is pretty moral people. This just reeks of a "creative techno-babble" solution to the real problem. That is what I mean when I say all this. TLDR I wish. Sorry for the wall o' text.

Oh how soon we forget heart-bleed. Did we EVER get a verification out of CCP that these Official EVE sites (and any certificates used elsewhere on third part sites in the future) are not OPEN SSL? It is on the site admin to make sure this has been fixed. Just saying.



Again - heartbleed, redirect DNS attacks - websites can actually appear in the address bar as actual websites and NOT be them. False certificates. See this link.

http://mashable.com/2014/04/17/heartbleed-digital-certificates/



I agree.

Well there you already have it...

1) With CharacterName i can search for your posts/opinions/killmails/whatnot...would prefer to keep that private

2) With ExpiresOn you can prepare for Wardecs to take POSes down, if someone goes on vacation...would prefer to keep that private

3) With CharacterOwnerHash you can crossreference on your own and other sites that you own or with ones that are willing to share who one's alts are, without even having access to a fullapi key...would prefer to keep that private


This seemingly unimportant information can already lead to exploit and metagaming cases...who knows what the final implementation will yield...

Also the malicious website owner will have more info which will be worth a lot more when you are identified...like your browsing history, IP and so on. He could for example DDOS you if you were a known Titan Pilot and he has your IP.

Don't mind him. He forgot to add an extra layer of tinfoil that morning.

Authenticated CREST will be handled in a similar fashion to Facebook and twitter.

It'll tell you what privileges it wants, as part of the authentication. So you have to approve those, to continue.

Just another screen during the log in process.

Now, CREST will also introduce something else. A 'refresh token'. When you auth, it'll only be good for X period of time. So you get a refresh token that can be used to regain the privileges. If you want to revoke them, you'll go to a site (which doesn't exist yet, but will before release.) and revoke the privilege.


(we keep going back to facebook and twitter as examples, as the systems are very similar)

This need to be possible regardless of trusting or not, one should have the ability to revoke access (plus I would need to know how to handle those errors when I suddenly cannot use the tokens).

/c

It is a single point of failure, but it's a pretty robust one. (though right now, with the launcher problems, my timing is impeccable ;) )