Skip to content
TORNLIFE More

PT Magno , Abusing API keys ( Torntuga)

Started by AltafHussain [2495972] on in General Discussion.

1,652 replies · 72k views · thread synced · 3 days ago · View on torn.com
About this thread

Posts archived: 1,653 / 1,653 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

Counted by TornLife from the archived posts.

Archived posts
1,653
Discussion span
→
Authority score
64 / 100
Historical score
62 / 100
Story score
83 / 100
Engagement score
98 / 100

People posting, likes and official posts are not counted for this thread yet: on threads longer than one page they come from a periodic pass over the archive, which has not covered it.

Most-liked replies

  • bogie [148747] Admin · 405 likes ·
    Hello everyone. Thank you for your patience, some more than others, in waiting for the results of this case. I will only be addressing the case itself here, I'm not interested in entertaining the several dozen pages of arguments in …
  • PROFY [2215152] · 167 likes ·
    Reset your API key when leaving any faction tbh
  • SeatLeonCupra [2581320] · 127 likes ·
    [image: media3.giphy.com] I've learned two things about playing Torn in the two years that I've been here: Defending yourself on the forums usually doesn't go well and even if you're a member of the PT "family" you do walk alone …

Mentioned in this thread

MaGnO [51498] ×9 daCampa [169777] ×2 Pops [1025410] ×1 xanty [1169571] ×1 XIII [1187920] ×1 mango2 [1357991] ×1 Gaab [1432032] ×1 TXMagnum [1741786] ×1 Freddo [2058023] ×1 Plunderpants [2072034] ×1 Superior- [2131856] ×1 CHINGADERA [2270005] ×1

AltafHussain [2495972] · #1 · edited
If you were ever in PT factions and gave your API key to leaders or PT website then RESET YOUR KEY RIGHT NOW!!

PT Website owner Magno has been abusing keys for a while, looking up your cash in hand and mugging you, this happened first few months ago when I got randomly mugged after a expired ghost trade, i immediately went to api screen and saw an unknown IP address checking my profile money and attacks i took screenshot as it turned out Magno stored everyone's keys and randomly used them to check money on hand and if you had money he would mug you.

https://i.imgur.com/9G7hZBl.png

Someone mugged you and stole $38,451,196 [view] 21:08:15 07/04/22

I gave them my key a whole year ago!
10:20:49 - 26/05/21 Dr_V accepted your faction application to PT-IronHearts
14:09:46 - 26/05/21 Kalaya kicked you out of PT-IronHearts

then it happend again, surely can't be a coincidence right?
https://i.imgur.com/7vpIOzI.jpg (key is reset)

14:33:53 - 01/07/22 Someone anonymously mugged you for $48,455,487 sending you to hospital for 0h 34m [view]

This happened while i was gambling and magno ran my api key somehow and got my money and mugged me. So if you ever gave your key to PT reset it, they say its deleted once you leave the faction but it is NOT TRUE!!

Proof that they say its deleted:
[image: i.imgur.com]
AltafHussain [2495972] · #9
ive already did , the requests were made on new API , he was somehow using old API to make request on new one thats why he's in fed too

the API i used in torntuga was based on previous system and request was made on the new API system
Blunt [2076337] · #10
Yea.. Best to reset API key regularly, especially between factions. Or just don't keep too much $ on hand... or both.
SporkMonkey [2065017] · #11
I know Magno in real life. He would never do such a thing. He is usually helping Ched's sweet, dear mother cross the street while her son makes a fortune developing some world war game.

Magno did make the mistake of impregnating Duke's sister, hence the temp fed hold. Told him to triple wrap his junk, but did he listen?

Nooooooo.
daCampa [169777] · #13 · edited
I can confirm the 48m mug was Magno, the other mug however isn't his (unless somehow the faction logs are incomplete). Do keep in mind that people don't need your key to stalk your public stats, like casino refils, so while in this case one of the mugs is fishy, that doesn't mean you'll be safe from mugs in the future from players that never had access to your key.

The keys stored on PT HQ can't be accessed by leaders, we chose to minimise the chances of breaches. Unfortunately that also means that we can't double check if the keys are actually deleted, and even if we could we'd have no way to know if someone had made a backup.

Staff are investigating this and other instances of similar behaviour, so until their conclusions are done the only thing I can do is apologize for Magno's actions towards you and any other potential victim(s).
bogie [148747] Admin Staff · #14
Whilst it's certainly a good idea to regularly change your API key I will say that there is still an acceptable usage policy for those who create programs for use with the API under the documentation.

https://www.torn.com/api.html#

Acceptable usage

This system has been developed so that you should only ever need to request an API key from the user. All of the user's information can be obtained with just their key, there shouldn't be any requirement to ask for a name or user ID. Torn passwords should never be requested from any users, ever.

You must keep keys, and the data obtained from them, securely protected and confidential unless permitted by the key owner. By accepting other user's keys, they are placing their trust in you - do not exploit this. We will permanently ban offending applications from accessing the API at a moment's notice.

We respectfully request that you follow Torn's no-advertising policy when building websites or applications that use our API system to ensure optimal user experience, however, exceptions can be made. Please contact us if you would like to advertise, accept voluntary real-money donations or charge users for usage.

Please make sure your scripts are optimised to retrieve only the information required for the specific request they're making. They should be retrieving as little information as possible; this will improve loading time and reduce stress on Torn's servers.
AltafHussain [2495972] · #15
thats what he's in fed for , how was he getting my API key when ive reset it already , ive also got my scripts and all the extensions checked by IBF if there was any leak but they were all good .
daCampa [169777] · #18
Then he either has some sort of backdoor or the reset button somehow doesn't work. If it's the last option then the devs have some serious homework to do
SporkMonkey [2065017] · #20
Temp fed does not equal perm fed. They are doing their due diligence, but it still doesn't make APIs work that way.

You can't base a new key to the lock on your home based on the old key to the old lock.