Skip to content
TORNLIFE More

Key usage logging?

Started by NichtGersti [3380912] on in API Development.

4 replies · 101 views · thread synced · 4 days ago · View on torn.com
About this thread

Posts archived: 5 / 5 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

Counted by TornLife from the archived posts.

Archived posts
5
Discussion span
→
People posting
3
Likes on archived posts
6
Authority score
51 / 100
Historical score
22 / 100
Story score
29 / 100
Engagement score
50 / 100
NichtGersti [3380912]

Thinking of the current controversy about TornPals key-usage (I personally trust it) I wanted to ask (or request that functionality) if there is a way to get all the log-entries of API key usage besides the most recent 10 you can see in the settings. In the documentation it is stated that "we log all details and inputs of requests", but are these available to the individual player?

The way I think it is atm assuming someone with malicious intent got hold of your key, they could e.g. make an API call and then do 10 other harmless looking calls to hide it.

Glasnost [1844049]

Looks like you nailed that timing xD

 

https://www.torn.com/forums.php#/p=threads&f=63&t=16401584&b=0&a=0&start=300&to=25956089

 

That being said, I did had a conversation with somebody lately about this as a potential project - a service to routinely collect key usage information from that API endpoint so as not to limit it to the last 250, then do an analysis on what is being collected, by who, the frequency of each selection etc. However, lots of details to figure out, but I'm curious if it would be of interest to anyone and, for example, some system to maybe flag up or alert people if a change is detected such as new API selections used, new IP etc.

Mentions: Upcoming API changes

NichtGersti [3380912]

I hadn't had a look at this so far. Only 250? Looks like such a service would be a good idea, otherwise the same problem as I described above still exists, just with 250 calls instead of 10. That's still possible in no time at all without the player noticing.

I think it would be enough to just store all the logs and allow the users to filter them. Automatic flagging might be overkill, I think at most let the user specify certain selections where they want to be alerted (e.g. if they gave a limited key to a service they wanna know if the key is used to get their money on hand).

Glasnost [1844049]

As weirdly niche as it sounds, I wonder if this would be a good application for an AI tool. Completely overkill I suspect, but nonetheless a thought I need to ponder.