EVE Technology Lab

+1

+1

This is a very important feature for wormhole living as this will let the FC know who is in the chain and in what ship types. Also useful to calculate the mass on holes. It also helps Corp mates to not roll out other corp members that may not be on comms.

Anyone from CCP can make statement to this ?

Hey all, here's the status drop:

I've just written up the CREST endpoint providing this info on a 5 second cache timer, essentially identical to the location endpoint. I might tweak that cache timer after we've done some performance testing, but I want to keep it as short as possible. It might end up in the ballpark of 10-30 seconds, or it might be fine; we'll see.

That'll be on Singularity fairly Soon™, but it may be disabled when it arrives on Tranquillity. This is due to concerns we have with authorizations granted to third party apps that users have forgotten to revoke[1].

Combining the low-cache-time location endpoint with a low-cache-time ship type endpoint dramatically lowers the barrier of entry for a malicious developer to abuse old and forgotten refresh tokens for near real-time intelligence. Because of this, we want to pre-emptively protect our players.

We're looking at a few ways to do this: Mandatory refresh token expiry for highly sensitive scopes is one option, and we're also considering the merits of a quarterly security review mail. We're actively working on this problem, but until we have mechanisms in place that we feel are adequate we will not be opening this endpoint on TQ.

More as it happens!

[1] You can do this at https://community.eveonline.com/support/third-party-applications/, go do a spring cleaning!

When granting access through SSO, display a time limit. Default to forever, one year, or six months. Allow players to manually select "until revoked" (if not the default), and additionally provide at least "one month" and "one week" options. "One day" may even be useful. If a "sensitive" scope is requested, default to a shorter option. Simply presenting the option reminds players, every time they login anywhere with SSO, that these things can last a long time after they have stopped using that app.

For an example consumer of these endpoints, an area where I have some experience is wspace mapping tools. I would find it a pain to require SSO once a month, there, and would happily choose a longer option. Since I would have several extra characters as scouts, each one needs to login when auth expires. Even mandatory one week limits could translate to many required logins, once per char, each day that I'm playing.

Both defaulting to lower time limits and allowing longer limits works better overall, with the main benefit being increased awareness to players. If the concern is "malicious developers", I doubt this time limit should even be available for apps to view. Once expired, non-malicious apps only need players to SSO again, and potentially-malicious apps (that is, all of them) shouldn't be able to discriminate against players who choose a shorter time.

What is the endpoints url?

Awesome! I´m looking forward to implement this in Pathfinder

1.
Why not a new permission + new endpoint that includes both?
Otherwise I'll be hitting you two queries at the same time with stupid amounts of overhead for what's just an extra key:value pair. I have no problem murdering CREST with 1k requests every 10 seconds multiplied by two otherwise, not my servers that'll be crying ;) Yes, siggy has a legitimate reason to query 1k requests, the total monitored characters is quite up there.

2.
Some of the security issues is because you guys squirrel the stupid SSO and API pages in the one place nobody looks (Support, but it's not really a "Support" item). It should be linked from Account Management and the Launcher. It should be named "EVE SSO / Crest" not "Third Party Applications". Your average player won't see a third party site calling itself "Third Party Application". They'll see "EVE SSO" or "CREST", they'll make the association easier if they see the same words.
I'm not saying a "security review email" is not a bad idea though.

So what's the status with ship info? Are we going to get it in November?
Also, do we get 5s cache time?

I support Jack Tronic's both points. New endpoint for getting both ship and location would be great (especially for CCP servers) because almost all use cases that I have in my mind includes getting them both.

I hope that you don't go to mandatory token expiry route, as that is going to be pain in the ass for valid users.