View source for Security of Third-Party Tools

__NOTOC__
= Security of Third-Party Tools =

Many developers produce third-party tools (software, spreadsheets, and websites) to enhance the EVE Online experience. While the majority are well-intentioned, some tools are created specifically to harvest intelligence on rival entities.

'''Every tool you authorize is a potential leak.''' Giving a tool access to your private EVE data (ESI) via SSO can result in a breach of personal privacy and compromise the [[OPSEC|Operational Security]] of the Imperium.
https://developers.eveonline.com/authorized-apps
== Assessing Tool Safety ==

As part of the [[Utilities]] revamp, we classify tools based on ownership and infrastructure to help you make informed decisions.

=== Classification Definitions ===
; Internally Developed
: The code was written by an Imperium member. These are generally trusted but not immune to bugs.
; Internally Hosted
: The tool runs on infrastructure controlled by GSF or an ally. The server logs and data are in friendly hands.
; Externally Developed
: Created by a third party. We have no control over the code's intent.
; Externally Hosted
: Runs on a server we do not control. The host can see who accesses it (IP addresses) and potentially harvest the data being processed.

=== The Trust Hierarchy ===
Trust is relative. When evaluating a new tool, consider the following hierarchy of risk:

* '''Standalone vs. Web:''' A local application (like Pyfa) is generally safer than a web application. Local data stays on your machine; web apps require sending data to a foreign server.
* '''Reputation:''' Established tools with years of history are safer than a new tool posted yesterday on Reddit by an unknown character.
* '''Source Code:''' Open Source tools are safer because they ''can'' be audited for backdoors. However, this is not a guarantee—just because code is public doesn't mean anyone has actually checked it.
* '''Internal Preference:''' Always prioritize Internally Hosted/Developed tools over external alternatives.

== EVE SSO Hygiene ==



The EVE Single Sign-On (SSO) allows tools to access your data even when you are logged out. Maintain strict hygiene regarding what you authorize.

* '''Minimize Exposure:''' Use the fewest number of external tools possible. If you don't use a tool daily, revoke its access.
* '''Check Scopes (Permissions):''' Read the requested permissions carefully.
** Does a fitting tool really need read access to your ''Location''?
** Does a market tool really need access to your ''Contacts''?
** If a tool asks for more than it needs, '''do not use it.'''
* '''Critical Thinking:''' Use common sense. If a random person links you a "cool new mapping tool" during a war, it is likely a trap to get your location.
* '''Regular Audits:''' Periodically review all authorized applications on the EVE Secure website.

=== How to Revoke Access ===
You should check your authorized applications list regularly and '''delete''' anything you are not actively using (e.g., old zKillboard authorizations, unused mapping tools).

'''Manage your Third-Party Applications here:'''
[https://developers.eveonline.com/authorized-apps https://developers.eveonline.com/authorized-apps]

'''Note:''' Never revoke '''GSF Auth''' for your Imperium characters, or you will lose access to alliance services.