EVE New Citizens Q&A

Probably going to eventually make some poor corp security guy's life difficult by pointing this out in a thread that new people might look to in the future... but you realize that any email you trash and then delete doesn't show up with API access either, right?

You can literally correspond with your out-of-corp conspirator via in-game mail about how you're snickering evilly at the fools that believe your story, then delete it, and as long as the guy with the key doesn't access it before you hit delete he'll never know.

And if you just clear all your mail on a regular basis you wouldn't be unusual, a recruiter calling that a red flag wouldn't be able to recruit ANYONE.

(Ain't no free lunches in Eve, is what I'm getting at, including when you're trying to hunt spies.)

People say deleted mails can still be pulled via API ...

First thing to check is the order skills were trained early in the character's life and check it matches the player's story.

If someone claims to be new to EVE, the #1 red flag is them having trained dangerous skills early on (e.g. being able to fit a Covert Cyno), or skills that do not sound interesting to rookies and aren't useful at low skills.
The #2 red flag is not having done several of the original tutorial missions.
And the #3 red flag is them following an extremely disciplined skill training plan from being new without any of the SP wasting you expect on a new player.

Next thing to check is asset transfers and how they got their first 200 million ISK, and how they make ISK now.
Do they redeem and sell PLEX? If so, they are likely to have more of a 'YOLO' attitude to assets in-game and so should not be put in positions where their errors will cost billions.
Are they a shrewd trader? If so, they probably value ISK highly and see loyalty as a currency - these people will be loyal then sell you out if the price is right.
Are they a 'hard worker' (made their ISK as a miner, etc)? These people can be taken advantage of.
Were they 'lucky' and got a few monster exploration pulls and made their first billion through selling deadspace modules they got from complexes? This is a red flag. This person has very carefully washed assets from an alt.

A limited API showing everything on the account except the contents of mail and that expires after 7 days is fine for security checks. I wouldn't ask for mail contents. EVEmails sometimes include personal details so if you send the API key to another person you *might* be an unintentional party in doxxing someone, and if someone is incompetent enough to have something incriminating in their EVEmails, they'll be incompetent enough to fail another test.




As someone that both does recruiting AND has done a small amount of joining corps as a 'disloyal member' (as a 'smash and grab' AWOXer, as a spy in wardecs and in attempted corp thefts), I can say that any corp that does not take operational security measures appropriate to the amount of assets the corp has and the corporation's profile is going to be a liability to its loyal members.

This does not change the fact that properly using API checks will keep out at least 90% of those types. Yes it will not stop a good one but there are few people willing to invest 6 months of paid sub into one account only to use it for something shady once and have that toon then be useless.



Again limited API check combine with minimum SP requirement to assure it's not a free throw away alt will eliminate the vast majority of problem causers. API checks are not fool proof but they are very helpful.

Personally I'd say when it come to assets it would be no ones business what I have scattered around. And if a corp wanted my full api I would ask for theirs first.
Trust goes both ways.
When I tried to get into eve in the past I got burned so much by corps.
eve tend to make people paranoid its the nature of the beast.
What often is forgotten is that it is not just a corp that take a risk by letting a player join. That player also take on a risk by joining the corp.

Simple fact is that if you are a high sec corp and you have open recruitment with no API checks and no SP requirement that you will be war deced for as long as you are taking in new members. Once you start doing API checks with an SP requirement you will watch your recruiting war decs go down to sometimes from always.

It's not an illusory threat it's just a fact of Eve.

Deleted in the sense of "in your trash bin", yes. Your eve-mail trash bin is as accessible as the rest of the mail.

Deleted in the sense of actually deleted, no. They'll have to pull them in the synch time of whatever they're using to access it, which is usually around 15 minutes. All that incriminating stuff from three months ago that you long since deleted? It's gone, unless you specifically saved it.

Essentially, your eve-mail is one of the things that no recruiter with half a brain actually cares about, so it's on the list of "if the corp wants this from you, you may be talking to a scammer instead of a recruiter" red flags.

The typical list for genuine recruiting offers is usually something like: Wallet transactions, Contact lists, Skills, market orders, kill/death reports. Much beyond that and you should start getting a bit narrow-eyed. And honestly if they want anything long-term (more than a month or two of trial period) other than K/D reports for killboard postings and maaaaaaybe contact lists, tell them to **** right off unless your'e willing to take the rather large risk that they're up to something sketchy with your data.

I don't think there is any need to freak out. If you do not want to give out your API, do not join corporations that require it and all is well.
Same if you think that people should give you api number for entry into your corp and they do not want to do that, just do not recruit them.

Some people require it and some don't. Lucky this game caters for everyone. And in the end if you want to join a corp badly enough in the end you will not care. If you are joining a corp without really caring about it, then you do not have to give your API.

You can even consider it a first loyalty check if you like.

Since this comment was attached to post about high sec corps one has to wonder what difference does it make?
For the overwhelming majority of high sec corps what could they possibly have that a spy would be interested in, or even be able to make use of?

My objection to APIs is no one needs to know who my alts are.