Player Features and Ideas Discussion

Try using basic internet security methods, the first one being that you don't open **** that you don't know what it is.

I'm suprised that Jita local isn't full of people abusing this. I guess it's one of less-known features and CCP probably thinks it isn't a big security hole (after all, not like people can delete your boot.ini with it).

I, too, am soft in the head and compulsively click on EVERY GODDAMNED LINK IN JITA LOCAL like a fool

At least you admit it.

I love kittens!

If you take a tiny bit of time to hover on a link before clicking on it, it tells you what the link is. I've never seen a destination posted that was so time critical that you couldn't wait for the pop-up to verify what you're clicking on.

Also, last I checked, spreading malicious code in that manner not only violates the TOS, which will get them banned, but actually violates the law in many countries. Try reporting it when you see it.

As far as I can tell, there's no obvious way to exploit this. EVE only attempts to open the link if it is of the form shellexec:http:... or shellexec:https:... , making it as safe as your browser. In contrast, the IGB is obviously and demonstrably insecure, and rooting the computer of anyone who clicks an IGB link to a site hosting exploits for the out of date chrome version used is trivial.

It's possible that I'm missing something of course, but the shellexec links are handled by executing rundll32.exe url.dll,FileProtocolHandler URL . rundll entry points get everything after the function name passed to them as a single string, so executing another local command by manipulation of the URL doesn't seem to be possible, but maybe a buffer overflow could be triggered in url.dll's FileProtocolHandler or (more likely) in EVE. A brief investigation didn't reveal any such vulnerabilities, so I'm inclined to say this is vastly more secure than the IGB.

1 why they hell are you playing full-screen borderless is your friend

2 don't click ransom links

Huge disagreement here. First of all, it isn't dangerous. Sure, it can send you to sites you don't want to go to, but if you have your normal browser set up in any reasonable way it shouldn't be a problem. It can't do anything except open an http or https link in your normal browser, so there's not much more potential for danger than opening it in the IGB.
Second, it definitely does have a use. For example, links to Google forms that can't be completed in the ingame browser. It's much more convenient to have a shellexec link to open the form in a working browser than to explain to people that it doesn't work ingame and that they need to copy and paste the URL. Another example is the way my corp has a link to our TeamSpeak server in the corp channel MOTD. It's quite handy for new recruits to just click the link and ok the redirect to open it with TeamSpeak.

Really the only abuse of it I've seen is making the occasional harmless troll link.

And what happens when the ingame browser is removed and all links open in an external browser? Or what if someone links something like that and tells people that it doesn't work in the ingame browser so they open it in an external browser themselves?