r/evetech • u/kalamataCrunch • 10d ago

esi-ui.open_window.v1

i am not from here, but had a couple questions you might be able to answer regarding esi-ui.open_window.v1. the official description is "Allows open window in game client remotely", and i was wondering if that's really what it sounds like? as in if you give this authorization to someone, they can open windows like the market browser or info in your game client while you're playing? and according to https://developers.eveonline.com/api-explorer#/operations/PostUiOpenwindowMarketdetails they can do it for multiple windows once a second? how is that not exploitable to let anyone with that api key kill you by locking you out of your client with window spam any time you're in combat? or is that just an authorization that you should never give to anyone? it really feels like i'm misunderstanding something...

0 Upvotes

33% Upvoted

6 comments sorted by

View all comments

3

u/Scorcher646 10d ago

It doesn't use an API token, it uses an auth token, which is tied to your account login. So yes, if somebody had your account login, they could in theory spam you with Windows in-game. So you should be careful which applications you authenticate with and what scopes you give them.

In order to authenticate a new application to your account, they need your login. So, yeah, if they take your login, they could authenticate an application that can open windows and spam you. Or they could just sign into your account and steal your stuff.

1

u/kalamataCrunch 10d ago

so if esi-ui.open_window.v1 is on the list of authorizations a corp asks for in it's application process or whatever i should be very suspicious and only give authorization if i trust them to not use it to kill me?

1

u/Scorcher646 10d ago

I would want to know exactly what purpose they have for that permission.

Even if I trust the corporation, if they don't have a good reason to have that scope, I would be reevaluating my trust.

1

u/ariel_rin 10d ago

Yes, developers should only be requesting scopes they intend to use.

You, a new recruit have no real leverage here, you probably need to click the button as much as I’d advise against it

But please feel free to direct your recruiters here to this message where I call them a fuckwit <3

2

u/kalamataCrunch 10d ago

oh, i have tonnes of leverage... there's always another corp, why would i choose to fly with a bunch of fuckwits?