These forums have been archived and are now read-only.

The new forums are live and can be found at https://forums.eveonline.com/

EVE New Citizens Q&A

 
  • Topic is locked indefinitely.
12Next page
 

Joining a Corp - API keys

Author
Darian Frey
Caldari Provisions
Caldari State
#1 - 2015-01-15 09:32:45 UTC
Just a really quick question before I do something I could regret...!

Is it normally to have to provide a never ending API key when joining a Corp to prove I'm not a machine or is it just part of a scam that I haven't figured out yet?
J'Poll
School of Applied Knowledge
Caldari State
#2 - 2015-01-15 09:43:43 UTC  |  Edited by: J'Poll
It is normal to ask for an API. But, most likely they only need it for a security/background screening.

However, there are also corps that require an API (usually a very limited one) to be able to access their forums/voice comms. This, again, for security reasons.


The first, ask them if a temporary API would work. If not, ask why they need a endless one. But, yes it is normal people ask for an API.

Also, you can always delete it if you arent happy about people using your API.

As for the 2nd example, usually that API only need the information that gives away in which corp you are. If said corp matches their whitelist, you can access their forums/voice comms.


Edit:

As a recruiter in the past, I always asked for a full API that was open for 4 weeks (the corp's trial period for new recruits). This way we could monitor the trial people for any devious information during that. If you made it through the trial, well you passed our trust check and thus we didnt need to monitor you so it was fine to let the API expire / dwlete it.

Personal channel: Crazy Dutch Guy

Help channel: Help chat - Reloaded

Public roams channels: RvB Ganked / Redemption Road / Spectre Fleet / Bombers bar / The Content Club

Gregor Parud
Imperial Academy
#3 - 2015-01-15 09:48:15 UTC
If it's a proper well structured corp that has recruitment requirements, a goal and the means to get there then sure, give them your API. If it's just a clown corp that isn't going anywhere at all then you might rethink it.

They can't really do anything with it other than gain intel on you, your alts, who your friends are, your mails etc etc etc. But since intel = power it's not something you just want to throw around. Make a habit of removing the API key after they are done with it (unless it's needed for continued security, as explained above)
Charlie Jacobson
#4 - 2015-01-15 09:54:13 UTC
Out of curiosity, what are the main things they check for with that API that isn't publicly available?
Chal0ner
Hideaway Hunters
The Hideaway.
#5 - 2015-01-15 10:20:25 UTC  |  Edited by: Chal0ner
Charlie Jacobson wrote:
Out of curiosity, what are the main things they check for with that API that isn't publicly available?


Payments to/from known enemies could be one.
mails to/from known enemies
known enemy alts

It depends on how intrusive they want the API.
Memphis Baas
#6 - 2015-01-15 10:53:06 UTC
Usually they are checking to see if you're an enemy spy. So they check your alts, and they look at your wallet history because people with multiple accounts and multiple alts often send money between them.
Liana Stenier
The Scope
Gallente Federation
#7 - 2015-01-15 11:21:32 UTC
Darian Frey wrote:
Just a really quick question before I do something I could regret...!

Is it normally to have to provide a never ending API key when joining a Corp to prove I'm not a machine or is it just part of a scam that I haven't figured out yet?


For some corps, it's policy -- I asked to join one that wanted a non-expiring full-access key , and when I asked if I cold give them a limited-access key, they said 'You can delete it when you leave the corp'.

Personally, I don't give anyone that level of access. Would you ask me for my bank account number and my mailbox key if I were applying to work with your real-world company? I don't think so, and I would refuse if you asked.
Velicitia
XS Tech
#8 - 2015-01-15 12:44:11 UTC
Liana Stenier wrote:
Darian Frey wrote:
Just a really quick question before I do something I could regret...!

Is it normally to have to provide a never ending API key when joining a Corp to prove I'm not a machine or is it just part of a scam that I haven't figured out yet?


For some corps, it's policy -- I asked to join one that wanted a non-expiring full-access key , and when I asked if I cold give them a limited-access key, they said 'You can delete it when you leave the corp'.

Personally, I don't give anyone that level of access. Would you ask me for my bank account number and my mailbox key if I were applying to work with your real-world company? I don't think so, and I would refuse if you asked.



Except that an API key isn't your bank acct number /mailbox key. Its access to your email sure (and other stuff), but what company these days *doesn't* say that they reserve the right to go thru your corporate email?

Tbh, in my experience, it's easier to get a full key (even for a month) because people tend to have trouble making limited ones. At least if you're limited to in-game channels (e.g. just starting out / don't have a corp site).

Now, if we're talking about an "established" group that has forums or some other out of game resource to provide recruits with the link for the desired key (e.g. standings, corp, other "minor" things) then that's fine too.

One of the bitter points of a good bittervet is the realisation that all those SP don't really do much, and that the newbie is having much more fun with what little he has. - Tippia

J'Poll
School of Applied Knowledge
Caldari State
#9 - 2015-01-15 13:02:04 UTC
Liana Stenier wrote:
Darian Frey wrote:
Just a really quick question before I do something I could regret...!

Is it normally to have to provide a never ending API key when joining a Corp to prove I'm not a machine or is it just part of a scam that I haven't figured out yet?


For some corps, it's policy -- I asked to join one that wanted a non-expiring full-access key , and when I asked if I cold give them a limited-access key, they said 'You can delete it when you leave the corp'.

Personally, I don't give anyone that level of access. Would you ask me for my bank account number and my mailbox key if I were applying to work with your real-world company? I don't think so, and I would refuse if you asked.


Too bad many big corps actually do a very deep background check when you apply for a job there.

Including, but not limited to:

* Ask / demand / look up criminal record history or lack there of.
* A full digital background check. What sites are you linked to and what did you put out there on the world wide web.

Personal channel: Crazy Dutch Guy

Help channel: Help chat - Reloaded

Public roams channels: RvB Ganked / Redemption Road / Spectre Fleet / Bombers bar / The Content Club

Chal0ner
Hideaway Hunters
The Hideaway.
#10 - 2015-01-15 13:10:36 UTC
J'Poll wrote:
Liana Stenier wrote:
Darian Frey wrote:
Just a really quick question before I do something I could regret...!

Is it normally to have to provide a never ending API key when joining a Corp to prove I'm not a machine or is it just part of a scam that I haven't figured out yet?


For some corps, it's policy -- I asked to join one that wanted a non-expiring full-access key , and when I asked if I cold give them a limited-access key, they said 'You can delete it when you leave the corp'.

Personally, I don't give anyone that level of access. Would you ask me for my bank account number and my mailbox key if I were applying to work with your real-world company? I don't think so, and I would refuse if you asked.


Too bad many big corps actually do a very deep background check when you apply for a job there.

Including, but not limited to:

* Ask / demand / look up criminal record history or lack there of.
* A full digital background check. What sites are you linked to and what did you put out there on the world wide web.


For a second I was confused as to wether you ment in-game or RL corporations ...
Gregor Parud
Imperial Academy
#11 - 2015-01-15 13:32:11 UTC
Chal0ner wrote:
For a second I was confused as to wether you ment in-game or RL corporations ...


Yeah, RL corporations can't hope to have the same level of back ground checking, leadership expertise, teamwork, security and intel gathering as we have here. The notion that fat, baby boomer lead, Ponzi scheme cubicle companies would even be on par with the organised entities we have here is preposterous.

Amateurs!
Aralyn Cormallen
Deep Core Mining Inc.
Caldari State
#12 - 2015-01-15 13:34:09 UTC  |  Edited by: Aralyn Cormallen
Liana Stenier wrote:
Personally, I don't give anyone that level of access. Would you ask me for my bank account number... ...if I were applying to work with your real-world company?


Yes, if you want to get paid at any point...
L'ouris
Have Naught Subsidiaries
#13 - 2015-01-15 15:47:39 UTC
Giving out the 'forever' API always sounds bad, however managing it can be a real pain in the butt.

Example:
Many bigger corps use the API for their voice comms, forums, reimbursement etc systems outside of Eve.
If you really wish to keep the API info all nice and protected, your likely re-setting your API info on the forums, voice system, reimbursement systems blah blah blah every few weeks.

I found that protecting that info comes at a high opportunity cost in time if you need access to all that other stuff to play the game.

Risk vs Reward:
how important is it to you that no person ever finds out about how much bounty iso your making when ratting or about that ship you have all nice and secure in personal hangers somewhere in Highsec that the corp would never be able to get at anyways? How much do you really care about deleting all the Eve mail you've ever gotten ever?

how much time is it worth to protect that info for you?


Personal conclusion:
Forever API keys are only a major security problem for important accounts / characters in game.
Joe line member or bob random in high sec really has nothing that valuable made available via API in the first place.
Easier to set and forget and get back to playing if its needed to fly with the group you actually have fun flying with.
Trey Kutoi
SergalJerk
Test Alliance Please Ignore
#14 - 2015-01-15 16:12:38 UTC
to be honest, one thing that scares me is the sheer amount of stuff in the API. Too much stuff tied to real life. I play eve to get away from it all, yet have the threat always hanging overhead.
Cara Forelli
State War Academy
Caldari State
#15 - 2015-01-15 16:16:24 UTC  |  Edited by: Cara Forelli
"Forever" APIs are only forever until you delete them. Make a separate one for each corp your apply to, always make them "forever", and delete them when you want to instead of letting them expire.

Most corps that require them just use them for recruiting (to check if you are a spy) but keep them on file just in case something bad happens (theft, awoxing) and an investigation needs to be made.

The bank account analogy is silly because APIs are view-only. And many companies do ask for your bank account number so they can direct deposit...not to mention your date of birth and social security number....

Unless you ARE a spy, or have some personal business secrets (market ventures etc.), APIs are no big deal. Anyone that tells you otherwise likely has a very inflated view of their own self-worth (no one cares how much money you have or what you are doing with it). That is assuming the corp isn't plotting against you already, which they don't need an API for.

There are exceptions of course. If I were suddenly to up and leave my corp I would need to scrub my mails of any director-level corp intel before I went giving out my API to anyone. But for the average member this is not an issue.

Want to talk? Join my channel in game: House Forelli

Titan's Lament

J'Poll
School of Applied Knowledge
Caldari State
#16 - 2015-01-15 16:27:17 UTC
Cara Forelli wrote:
"Forever" APIs are only forever until you delete them. Make a separate one for each corp your apply to, always make them "forever", and delete them when you want to instead of letting them expire.

Most corps that require them just use them for recruiting (to check if you are a spy) but keep them on file just in case something bad happens (theft, awoxing) and an investigation needs to be made.

The bank account analogy is silly because APIs are view-only. And many companies do ask for your bank account number so they can direct deposit...not to mention your date of birth and social security number....

Unless you ARE a spy, or have some personal business secrets (market ventures etc.), APIs are no big deal. Anyone that tells you otherwise likely has a very inflated view of their own self-worth (no one cares how much money you have or what you are doing with it). That is assuming the corp isn't plotting against you already, which they don't need an API for.

There are exceptions of course. If I were suddenly to up and leave my corp I would need to scrub my mails of any director-level corp intel before I went giving out my API to anyone. But for the average member this is not an issue.


Uhm even deleted mails stay in the API for some time Cara... IIRC

Personal channel: Crazy Dutch Guy

Help channel: Help chat - Reloaded

Public roams channels: RvB Ganked / Redemption Road / Spectre Fleet / Bombers bar / The Content Club

Cara Forelli
State War Academy
Caldari State
#17 - 2015-01-15 16:29:53 UTC
J'Poll wrote:
Uhm even deleted mails stay in the API for some time Cara... IIRC

Good to know. Guess I'm stuck with you all for a while....

Want to talk? Join my channel in game: House Forelli

Titan's Lament

Utari Onzo
Escalated.
OnlyFleets.
#18 - 2015-01-15 17:57:26 UTC
As a recruiter I ask for full api for all accounts, no exceptions. They can be temprorary as I normally do the checks as soon as I get them.

Things I and most competant recruiters are actually looking for:

Arrowlarge transfers of isk between characters, especially characters I don't have APIs for
ArrowCorporate wallet withdrawals, usually if the guy is a wormholer I ignore anything less then a couple bill of isk because of sleeper loot payouts, but large sums being withdrawn suddenly is a strong indication of corp theft.
ArrowLarge amounts of selling items/ships without history of having bought those items/ships
ArrowChecking assets for ships the character cannot fly/large bulk amounts of items but no history of being a trader
ArrowEvemails, specifically anything that might show tendancy to reveal information/spying

Generally, it's all about the isk and following it. Spies that aren't very good usually leave little paper trails with the isk and assets rather then in their mails, items that the character sells without having bought them/history of regular player trades/contracts/ buying items for unusually low prices from the same characters then reselling for large profit are usual tells that a player is trying to feed a spy alt isk on the quiet. As long as everything all adds up in a nice package I'm normally happy to tell the applicant to go ahead and delete the api once we get them in for a teamspeak interview. We strictly manage hangar/pos access, so even if a corp thief got in the damage they could do is very limited till they've been 'in' for a good while and most just aren't that patient. Still, this is eve and anything is possible.

"Face the enemy as a solid wall For faith is your armor And through it, the enemy will find no breach Wrap your arms around the enemy For faith is your fire And with it, burn away his evil"

Tau Cabalander
Retirement Retreat
Working Stiffs
#19 - 2015-01-15 18:47:38 UTC  |  Edited by: Tau Cabalander
J'Poll wrote:
* Ask / demand / look up criminal record history or lack there of.
* A full digital background check. What sites are you linked to and what did you put out there on the world wide web.

Phew! My BITNET personna is safe.

You can find my Q-Link and CompuServe account if you search really hard. Nothing on my GEnie account though.
Dradis Aulmais
Center for Advanced Studies
Gallente Federation
#20 - 2015-01-15 18:52:15 UTC
I have always required a full apo key with no expry from my members. I usually only keep it for a month unless you have a role that gives you access to any corp assets or responsiblity

Dradis Aulmais, Federal Attorney Number 54896

Free The Scope Three

12Next page