These forums have been archived and are now read-only.

The new forums are live and can be found at https://forums.eveonline.com/

EVE General Discussion

 
  • Topic is locked indefinitely.
 

API Key Question

First post
Author
Mara Pahrdi
The Order of Anoyia
#21 - 2017-03-04 15:47:36 UTC
Wander Prian wrote:
Amojin wrote:
Wander Prian wrote:
Also, this is a game, not real life. Your "privacy" extends as far as CCP not revealing your personal information. Don't be an idiot and put sensitive information into a in-game mail.


When you step outside the game, you are in real life. A Full-API key gives you information about the player, that you then use, in game. So, follow what you, yourself, just said, and deal with the game, the WHOLE game, INSIDE the game?

'Well, sure, when it comes to stomping little folks, but when my big corp and my assetts might be at risk? Hell no, are you crazy? Racist!' -- the responses so far, condensed into a meaningful statement of intent.

API only gives information about the characters. I cannot see your personal information. Everything is kept within the game.

That said, Blizzard i.e. is way more intrusive regarding private information with their real id. I still remember the real id war and Blizzards struggle to make every player transparent in real life. They finally gave in and the worst changes did'nt go live. But there's still way more subtle pressure to reveal rl information to other players in WoW than in EVE.

Remove standings and insurance.

Amojin
Doomheim
#22 - 2017-03-04 15:54:05 UTC  |  Edited by: Amojin
Mara Pahrdi wrote:

API only gives information about the characters. I cannot see your personal information. Everything is kept within the game.
That said, Blizzard i.e. is way more intrusive regarding private information with their real id. I still remember the real id war and Blizzards struggle to make every player transparent in real life. They finally gave in and the worst changes did'nt go live. But there's still way more subtle pressure to reveal rl information to other players in WoW than in EVE.



That's true, but the aim of Blizzard is to integrate with social media. CCP is not the one, here, trying to get personal information, it's the players. An API is usually present for one reason - to allow developers to create tools to help you with the game. That fitting tool, for example, uses the API, and it does so appropriately. It uses the API you enter, for YOUR use, to help you. It doesn't send the API key off to other players.

Differing from WoW, CCP's API does not give out personal information about the player - what it does give out is personal information beyond the character in question, i.e., metadata, about a players actions that you would not have access to in game. This is a very different type of abuse than what Blizzard intended, and CCP are not the ones doing it - the players are, because they just have to be able to be, out of game, as 100% certain as they can be that they know all about you.

You would not normally know every skill a player has, how much isk, where his alts are at and what they have. These facts being in evidence, I find your comparison to be irrelevant. You're throwing out a red herring?
Ptraci
3 R Corporation
#23 - 2017-03-04 16:31:07 UTC
Amojin wrote:

If you can't win the argument insult the other side,


Oh it's not an insult it's a statement of fact. You're trolling. The only argument is in your head. API requests from corporations are not negotiable. I would ask for a DNA sample if I could - because after all a DETERMINED malicious person could just make an entirely new account and keep it completely separate. A DNA sample collected by a reliable 3rd party would at least assure me that I was dealing with a particular human being.

However you seem to think that this is all some sort of conspiracy by "those in power" to crush the little guy, etc. Dude - your API key can be revoked by you at any time. API does not confer control of your EVE account. If you don't want people to read your EVE mails or see your wallet transactions you can purge them before handing over your API (although this is an immediate red flag).

In short - if you don't want to do it - DONT DO IT. But quit ranting about it as if you were being oppressed by Donald Trump or something.
Amojin
Doomheim
#24 - 2017-03-04 16:37:21 UTC  |  Edited by: Amojin
Ptraci wrote:
Amojin wrote:

If you can't win the argument insult the other side,


Oh it's not an insult it's a statement of fact. You're trolling. The only argument is in your head. API requests from corporations are not negotiable. I would ask for a DNA sample if I could - because after all a DETERMINED malicious person could just make an entirely new account and keep it completely separate. A DNA sample collected by a reliable 3rd party would at least assure me that I was dealing with a particular human being.

However you seem to think that this is all some sort of conspiracy by "those in power" to crush the little guy, etc. Dude - your API key can be revoked by you at any time. API does not confer control of your EVE account. If you don't want people to read your EVE mails or see your wallet transactions you can purge them before handing over your API (although this is an immediate red flag).

In short - if you don't want to do it - DONT DO IT. But quit ranting about it as if you were being oppressed by Donald Trump or something.


It's only 'trolling' when you disagree with something? What is it, exactly, that you think constitutes 'trolling?' I'm talking about the subject *I* raised, not randomly calling you names. And, yes, API requests from corporations ARE negotiable. That you think they are NOT and SAID so, well, that just proves the point, doesn't it? In your mind you have an absolute right to out-of-game metadata about the content, behaviors, and resources of all my toons.

But, in all other matters, well, perfect intel can't be had - sometimes you just don't know, EVE is a game about risk vs. reward...

Blah, blah, blah. I feel it important to raise this point, because it's quite possible that newer players just hand over those keys without really realizing that you can cache the data; even if he revokes the key at a later date, you have a very useful snapshot of intelligence that will age very nicely, in case he leaves your corp and you're angry. Players giving away that api-key are making much more of an investment in you than you are in them.

That meta-data is something you could never learn, in the game. It seems to be the one big area where the rich all of a sudden are not quite so content with imperfect intelligence. No, not when their stuff is on the chessboard instead of safely secured, right?
Mara Pahrdi
The Order of Anoyia
#25 - 2017-03-04 16:48:11 UTC
Amojin wrote:
Mara Pahrdi wrote:

API only gives information about the characters. I cannot see your personal information. Everything is kept within the game.
That said, Blizzard i.e. is way more intrusive regarding private information with their real id. I still remember the real id war and Blizzards struggle to make every player transparent in real life. They finally gave in and the worst changes did'nt go live. But there's still way more subtle pressure to reveal rl information to other players in WoW than in EVE.



That's true, but the aim of Blizzard is to integrate with social media. CCP is not the one, here, trying to get personal information, it's the players. An API is usually present for one reason - to allow developers to create tools to help you with the game. That fitting tool, for example, uses the API, and it does so appropriately. It uses the API you enter, for YOUR use, to help you. It doesn't send the API key off to other players.

Differing from WoW, CCP's API does not give out personal information about the player - what it does give out is personal information beyond the character in question, i.e., metadata, about a players actions that you would not have access to in game. This is a very different type of abuse than what Blizzard intended, and CCP are not the ones doing it - the players are, because they just have to be able to be, out of game, as 100% certain as they can be that they know all about you.

You would not normally know every skill a player has, how much isk, where his alts are at and what they have. These facts being in evidence, I find your comparison to be irrelevant. You're throwing out a red herring?

Obviously the scope of the games are somewhat different.

Still there are tons of metadata available in what Blizzard publishes about characters on it's websites. And if you know how to read it, you get a very decent player profile, just like in EVE.

Sure, you cannot read mails and don't see how much cash there is in their wallet. But the real id enables you to see all characters on an account.

I'm still in touch with a couple of players from my old WoW community, that I left 6 years ago. Every once in a while I check their guild and character profiles and I have a pretty good grasp of what they have been doing in the last months and what they are currently up to. Without having to ask them personally.

Add to that the statistics available via addons during test raids and within the scope of the game a WoW player is no less transparent to a raid recruiter than he is to a corp recruiter with a full API in EVE. Maybe even more so.

This can have all kinds of stupid consequences. I've seen some of them personally during my WoW time. It's not much different here. But you also have to consider, that EVE gameplay allows for things to happen, that are forbidden in most other games. You do need tools to at least partly counter them. It is part of game balance.

Remove standings and insurance.

Amojin
Doomheim
#26 - 2017-03-04 16:54:47 UTC  |  Edited by: Amojin
Mara Pahrdi wrote:

Obviously the scope of the games are somewhat different.

Still there are tons of metadata available in what Blizzard publishes about characters on it's websites. And if you know how to read it, you get a very decent player profile, just like in EVE.

Sure, you cannot read mails and don't see how much cash there is in their wallet. But the real id enables you to see all characters on an account.

I'm still in touch with a couple of players from my old WoW community, that I left 6 years ago. Every once in a while I check their guild and character profiles and I have a pretty good grasp of what they have been doing in the last months and what they are currently up to. Without having to ask them personally.

Add to that the statistics available via addons during test raids and within the scope of the game a WoW player is no less transparent to a raid recruiter than he is to a corp recruiter with a full API in EVE. Maybe even more so.

This can have all kinds of stupid consequences. I've seen some of them personally during my WoW time. It's not much different here. But you also have to consider, that EVE gameplay allows for things to happen, that are forbidden in most other games. You do need tools to at least partly counter them. It is part of game balance.


You do raise some good points, so let me respond to them one by one. Yes, I have had that happen, in Wow. I don't give out my realID very frequently, and only to people I know in real life. But, it's less of a risk, there. They can use it for recruitment and such, but seeing my gear is not too terrible a risk. In WoW, you can pretty much be assured that a toon at end-game content is wearing, if not BiS, transitional gear that has the right stats for their role.

I also don't lose the gear when I die in a BG or Arena match, so money is really quite useless in Wow, beyond a certain point. Here, a loss means a loss of the equivalent 'gear,' and being able to see what people have trained is clearly invaluable intelligence if you bear them ill will.

It's only very loosely comparable, too loosely, imo, for it to be relevant as an argument.
Ptraci
3 R Corporation
#27 - 2017-03-04 17:06:20 UTC
Amojin wrote:

It's only 'trolling' when you disagree with something? What is it, exactly, that you think constitutes 'trolling?'


This constitutes trolling. You asked a question. You got answers. You've made your opinion clear that you disagree with API requests. You've been told pretty clearly by several people that regardless, API requests will continue from those who have "skin in the game". Then you liken this to some sort of political persecution or civil rights violation. Get over yourself, troll.

Yes troll. As in, shiptoasting to merely provoke a response. I guess you crave attention or something, this thread should have died about a dozen or so posts ago. Everyone's point has been well made. Yet you keep it going. That's trolling.
Amojin
Doomheim
#28 - 2017-03-04 17:09:43 UTC  |  Edited by: Amojin
Ptraci wrote:
API requests from corporations are not negotiable. I would ask for a DNA sample if I could - because after all a DETERMINED malicious person could just make an entirely new account and keep it completely separate. A DNA sample collected by a reliable 3rd party would at least assure me that I was dealing with a particular human being.


Ptraci wrote:
This constitutes trolling. You asked a question. You got answers. You've made your opinion clear that you disagree with API requests. You've been told pretty clearly by several people that regardless, API requests will continue from those who have "skin in the game". Then you liken this to some sort of political persecution or civil rights violation. Get over yourself, troll.

Yes troll. As in, shiptoasting to merely provoke a response. I guess you crave attention or something, this thread should have died about a dozen or so posts ago. Everyone's point has been well made. Yet you keep it going. That's trolling.


You said both of these things, did you not? You say I liken it to some real life stuff, civil rights and all... Says the person who WOULD IF SHE COULD, COLLECT DNA!!!!

This is absolutely incredible! And I mean that as in the actual definition of the word, not as a compliment.
Algarion Getz
Aideron Corp
#29 - 2017-03-04 17:15:46 UTC
Its simple, dont join a corp if you dont want to provide your full API key.
Amojin
Doomheim
#30 - 2017-03-04 17:22:15 UTC  |  Edited by: Amojin
Algarion Getz wrote:
Its simple, dont join a corp if you dont want to provide your full API key.


Yes, it's very simple. Even though this is a game where you have to be part of a team to get ahead. That's like Facebook taking over pretty much the entire online social media spectrum, buying up everything in sight. Well, if you don't like censorship, don't be on Facebook!

They have the right to do whatever they want - they're a private corporation! Except, they're really a bit more, aren't they? A lot of these corporations have used their massive financial power to completely monopolize a segment of industry. Since everyone uses them, they are basically a public utility, and are in fact, publicly traded. They should not be able to hide behind 'it's a company, so we can do whatever we want.'

You know what, corporations do the same thing, in EVE. They have all the cards, so they think that no rules need apply to them, that they can violate every precept of moral behavior, use out of game information, to protect themselves and their riches.

Will they keep doing this? Yes, so long as people let them. If, however, a significant number of players decide to start withholding those keys, and not playing that game? The situation will change. I'd like to see that situation change, so of course I have to be vocal about the ills and evils of the current system, now don't I?

Edit: Also, when someone not only defends this crap, but tells me to get over myself nearly in the same breath they used to proclaim they would collect dna if they could? That potent a defense, that level of real life paranoia, means you have gone insane - this is no longer a GAME to a person like that. It's their life.
Mara Pahrdi
The Order of Anoyia
#31 - 2017-03-04 17:41:59 UTC
Amojin wrote:
Here, a loss means a loss of the equivalent 'gear,' and being able to see what people have trained is clearly invaluable intelligence if you bear them ill will.

Blink

Remove standings and insurance.

Amojin
Doomheim
#32 - 2017-03-04 18:26:09 UTC  |  Edited by: Amojin
Mara Pahrdi wrote:
Amojin wrote:
Here, a loss means a loss of the equivalent 'gear,' and being able to see what people have trained is clearly invaluable intelligence if you bear them ill will.

Blink



Twisted

Ms. DNA also just let slip what a huge advantage of theirs that I've decided to lock onto. Taking this away would really hurt corporations badly, making them play on a level playing field without perfect knowledge. If it were NOT so VALUABLE, the fight would have been ho-hum, whatever, we'll stop asking for it, no big deal; we respect our player's privacy, and we value you, so we'll quit being unreasonable. lol

You can usually tell when you've hit a soft spot by how hard your enemy squeals, and in the very rich, the ones bragging about their trillions of isk, the panic over even the thought was pretty intense. So, yeah, hit them with it if you're tired of their crap.
Wander Prian
Nosferatu Security Foundation
#33 - 2017-03-04 18:34:42 UTC
If the API gives perfect intel as you claim, why does corp-thieves,spies and awoxers still appear in the game?

Wormholer for life.

Amojin
Doomheim
#34 - 2017-03-04 18:37:31 UTC
Wander Prian wrote:
If the API gives perfect intel as you claim, why does corp-thieves,spies and awoxers still appear in the game?


Your pal already answered you.

Ptraci wrote:
after all a DETERMINED malicious person could just make an entirely new account and keep it completely separate. A DNA sample collected by a reliable 3rd party would at least assure me that I was dealing with a particular human being.


I already pointed out the vast number of Discretionary Access Controls available in the game, for roles, hangars, storage of all types. If you can't be troubled to configure it, or make a mistake... Oh well.
Amojin
Doomheim
#35 - 2017-03-04 19:02:34 UTC
I've been told that an admin will lock threads on request. If that's so, you may as well lock this one. I think the lines were pretty clearly drawn, and there's really not much more to say without this degenerating into another virtual shouting match.
Mara Pahrdi
The Order of Anoyia
#36 - 2017-03-04 19:07:30 UTC
Amojin wrote:
If you can't be troubled to configure it, or make a mistake... Oh well.

To be fair, the corp ui is a ******* mess and calling it unintuitive is just short of blasphemy. It often does not respond properly. So you wonder whether the change you just made did happen or not and check thrice, just to be sure.

I can't imagine how this must be in a big corp. Were I not in my tiny little tax evasion corp, and someone asked me to take responsibility in another corp and work with the corp ui, I'd outright refuse it.

It's pretty much the same with corp offices and the handling of secure and log containers. One can only hope, that CCP has the right ideas when they do redesign the corp ui.

Remove standings and insurance.

Amojin
Doomheim
#37 - 2017-03-04 19:40:42 UTC  |  Edited by: Amojin
So, your 'guess' is that when the UI allows people to do the job in game, they'll stop meta-gaming with API keys?

If so, it will be one of the very few times where power was willingly laid aside, by anyone. I'm not holding my breath, to be sure.
Mav Ahishatsu
Doomheim
#38 - 2017-03-04 21:54:13 UTC
Amojin wrote:
I've noticed that a great many corps in game require a full api key in order to join. I understand their paranoia, but isn't it a bit much, and yes, one of my favorite terms, again, META-gaming, to have access to more than the character you're actively considering?

I question why you should have the right to see all of my toons, on the account. This is not going to really provide you with any 'security,' is it, since I can just create multiple accounts? I'm not sure what right you have to see my mails, my current location in space, and have access to my 'wallet' status, either.

As usual, I feel I must be missing part of the picture. Is there any legitimate, gaming reason for a corp to have a full api key, or is it just an invasion of privacy, and actually far more risk to me to give it to them, than it is to them for me to not do so?


The defensive responses you've received are a clear indication that you're correct. I can see why this would be a red flag for you when attempting to join a corporation. The in-game mechanics are as adequate as anything else when it comes to preventing corporate theft. Potential thieves are aware of the situation regarding API keys and the fact that they will need a seemingly trustworthy account to carry out their plan. Putting anyone in a position of power is a risk regardless of what you think you know about them.

Requesting API keys is a sign of fragility and fear which shows that you have something of value to be stolen. Either that or you have an unhealthy interest in the applicant's assets. A thief would in fact be more likely to hand over their API key willingly in comparison to an honest player who just wants to join your corporation. An honest player is taking a risk themselves when they place their assets in the hands of your corporation. Requesting API keys is a sign of weakness to thieves and to an honest player, a sign that your corporation cannot be trusted.
Scipio Artelius
Weaponised Vegemite
Flying Dangerous
#39 - 2017-03-04 22:22:54 UTC  |  Edited by: Scipio Artelius
Amojin wrote:
I question why you should have the right to see all of my toons, on the account. This is not going to really provide you with any 'security,' is it, since I can just create multiple accounts? I'm not sure what right you have to see my mails, my current location in space, and have access to my 'wallet' status, either.

'Right to see' is probably not the correct term.

They don't have a right. They request it. You either agree, or go elsewhere. It's totally in your control.

But, from the questions I ask, many of the Corps that request a full API have no clue what they are doing and are not important enough to need it for new people joining anyway. They do it, because...that's what's done.

For people you want to give roles to, sure. That's a totally legit reason to request full API access, but just for new people joining, not so much. Corps who have their assets at risk of theft from even new members and who don't maintain security over information have other things to worry about than requesting APIs.

Just my 0.02, not necessarily anymore right than any other response.
Cade Windstalker
#40 - 2017-03-05 01:12:12 UTC
Hmm, lets see if I can knock out an explanation, though I'm not thinking you're going to like it.

First off, yes this is metagaming, because Eve is a game that's as much about the metagame as the game itself. Requesting full API keys is, in this sense, perfectly fair because it's a metagame defense against metagame actions.

A corp wants to see your other characters because they might belong to corps belonging to their enemies.

They want to see your wallet history to make sure you haven't received payments from their enemies.

They want to see your mails to make sure you haven't been in contact with their enemies.

None of this is going to be foolproof, but it makes it harder to infiltrate and AWOX and that's the goal here. Just because your precautions won't cover everything doesn't mean they're not worth doing.

Amojin wrote:
Yes, it's very simple. Even though this is a game where you have to be part of a team to get ahead.


Yup, which requires trust or you'll find yourself with a knife in your back in fairly short order. Spies and sabotage are part and parcel of the game in Eve, so it would be fantastically unwise for a corp not to take precautions against them. If you want them to trust you enough to let you join their corporation then you need to show that you trust them with the details they need to be able to trust you.

After all, trust is a two way street.

This is no different than a real life employer requesting permission for a background check. You can avoid that if you like, but that's going to significantly limit your employment options.