EVE General Discussion

Remember though that removing the API would also remove your ability to use third party applications. But then again I supposed if you're all really this crazy about people spying on you, you don't give out API keys to third party applications either, since they have also been known to harvest information.

As well, alt lists are created from API Keys and if that info gets stolen or is traded to others for what ever reason and your enemies get their hands on that they would know your alts, and maybe even track your assets if the get the keys as well.

And if you have a out of corp Orca / Bowhead / Freighter / JF alt you could find yourself compromised very quickly and in the need of a new ship.

Personally been on an OP like that myself. Nice KM too :)

You must be in a rather small Corp. You must trust people with roles in larger Corps or people will leave because nothing ever gets done.

Sure, but if you're in a corp and they're just handing people roles without vetting them, that's worse than simply not giving out roles. And trust works both ways. Why should a corp CEO trust someone with roles if the player won't even trust the CEO with in-game information about their characters.

I actually think it's pretty funny when you give people roles who really shouldn't have roles.

Great stuff happens, like someone spending your entire alliance wallet buying far too many rattlesnakes because they don't realize that they're going into market deliveries so they just keep clicking the button over and over for twenty minutes.

You know who you are.

He doesn't but will HE give me HIS API? Most likely not. I have no Problems if someone checks my wallet but mail is personal Information and if someone uses mail and not an open channel there might be a reason for it. If I Hand over These informations I'm betraying his trust.
If they want to check me, that's okay but constant Observation sounds to much like Mittens Paranoia. If I give out the API I can still communicate with any 3rd party tool. So you might only get the dumb spys but will miss the really clever ones and that are the dangerouse ones.

I guess a lot of us just don;t see it as a barrier to entry. I'd be far happier to see more API checks and less hard SP limits. The API really doesn't contain information of value, and the people being so overly protective of it usually do so because they don't understand it. Amusingly most of them are perfectly happy to jam it into third party applications without a second thought though.

I imaging not, since you have no real reason for needing his API beyond wanting too peruse his information. If I were joining a corp and the CEO didn't want my API, that tells me he doesn't want other people API, and so he may be recruiting people who want to steal from me. By taking an API key he's enforcing a minimum level of effort for those types of pilots, in most cases (because most corporations aren't massive) a level of effort that makes it not worth the potential payout.

Why are you using an in-game mail service for personal information anyway? The security on in-game information isn't as good as it's not covered by data protection laws, which is why people dropping into random private channels or seeing each other hangars and such when bugs have happened hasn't resulted in massive fines levied. Nothing anyone can fetch through the API should be of any real world significance. That why CCPs EULA states "Except for certain information in your Account (discussed below), all transmissions by you to the System are not private. You acknowledge and agree that you have no expectation of privacy regarding communications you make in the Game, whether through private in-Game messaging, during chat, or in chat rooms".

It's less about constant observation, and more about keeping your records up to date. When I was responsible for API checks, I would expect them to be non-expiring. This isn't so I can keep tabs on you, trawling through multiple APIs each day is not something most people enjoy doing. Beyond the initial check, most APIs never get looked at again until a situation arises that requires people to look at them again.

The last time someone tried to steal something from my previous corp, it was easy to narrow down the possible suspects because only a handful of people didn't have valid API keys. A simple request sent out to those people instantly narrowed it down to a single suspect who was hesitant to comply (they were all Directors who had been in their positions longer than I had, so I hadn't asked until it was necessary.) In the end he relented, believing he had sufficiently removed any trace of his crime from his account. It was the glaring lack of data for the time period surrounding the theft that gave it away. The assets were returned, he was publicly shamed, and departed the corp soon after.

The time before that, in another corp, our hapless CEO had rather foolishly granted roles to a member without ensuring the roles were set up correctly, which cost the corp the entirity of its physical assets. Once again, it was one of the few members who had not provided an API key responsible. He refused when asked, and my suspicions were confirmed upon checking the audit logs which showed he had removed his roles moments after the act. Apparently while I was on an extended break, our CEO made the same mistake again.

People are right to question why they should be required to provide this information, but in most situations it is for their own benefit. If you walked into a bank and saw their vault open and stacks of gold bars on display with no security in sight, would you open an account there? I'd hope not, and the same is true of Corp security. Having been the guy checking APIs, I find it somewhat reassuring that someone is at least attempting to keep an eye out for spies, thieves, and awoxers when I apply to a corp.

this is really simple... if the corp you want to join is worth it then give your API, if not, move on.

The CEO, the directors, the guy that wrote the corp API key applications, the guys that manage the alliance security ...
You see, it is not 1 person, it is several persons and you don't have any idea who are several of them.