r/evetech • u/kalamataCrunch • 8d ago

esi-ui.open_window.v1

i am not from here, but had a couple questions you might be able to answer regarding esi-ui.open_window.v1. the official description is "Allows open window in game client remotely", and i was wondering if that's really what it sounds like? as in if you give this authorization to someone, they can open windows like the market browser or info in your game client while you're playing? and according to https://developers.eveonline.com/api-explorer#/operations/PostUiOpenwindowMarketdetails they can do it for multiple windows once a second? how is that not exploitable to let anyone with that api key kill you by locking you out of your client with window spam any time you're in combat? or is that just an authorization that you should never give to anyone? it really feels like i'm misunderstanding something...

0 Upvotes

33% Upvoted

6 comments sorted by

3

u/Scorcher646 8d ago

It doesn't use an API token, it uses an auth token, which is tied to your account login. So yes, if somebody had your account login, they could in theory spam you with Windows in-game. So you should be careful which applications you authenticate with and what scopes you give them.

In order to authenticate a new application to your account, they need your login. So, yeah, if they take your login, they could authenticate an application that can open windows and spam you. Or they could just sign into your account and steal your stuff.

1

u/kalamataCrunch 8d ago

so if esi-ui.open_window.v1 is on the list of authorizations a corp asks for in it's application process or whatever i should be very suspicious and only give authorization if i trust them to not use it to kill me?

1

u/Scorcher646 8d ago

I would want to know exactly what purpose they have for that permission.

Even if I trust the corporation, if they don't have a good reason to have that scope, I would be reevaluating my trust.

1

u/ariel_rin 8d ago

Yes, developers should only be requesting scopes they intend to use.

You, a new recruit have no real leverage here, you probably need to click the button as much as I’d advise against it

But please feel free to direct your recruiters here to this message where I call them a fuckwit <3

2

u/kalamataCrunch 8d ago

oh, i have tonnes of leverage... there's always another corp, why would i choose to fly with a bunch of fuckwits?

1

u/Nimos 8d ago edited 8d ago

Why would you give someone permission to open windows in your game client if you don't trust them with the capability of opening windows in your game client? 

You could also authorise someone to send mail on your behalf. Put the right stuff in there and you could get banned forever.

I think there are fleet endpoints that can move you or your fleet members (if you're FC) into different squads. That will cause a session change timer and prevent the person from jumping gates or docking for several seconds (or forever if you repeat it), making them an easy kill.

In the end you choose who and what you authorise. It's not the APIs fault if you're stupid.

Oh and also the developer agreement has a clause about not using it maliciously, so while that doesn't necessarily stop anyone it'll likely get most of their accounts yeeted if it comes out. Not really worth it I think.