Skip to content
TORNLIFE More

SYS stock API flaw

Started by Kapten [829679] on in API Development.

2 replies · 193 views · thread synced · 7 days ago · View on torn.com
About this thread

Posts archived: 3 / 3 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

Counted by TornLife from the archived posts.

Archived posts
3
Discussion span
→
People posting
2
Likes on archived posts
9
Authority score
51 / 100
Historical score
20 / 100
Story score
28 / 100
Engagement score
47 / 100
Kapten [829679]
Target of suggestion: Prevent scripts from using the API to bypass the ability of Syscore MFG (SYS) stock benefit to make your bounties non-traceable.

The Syscore Benefit Block prevents your anonymous bounties being revealed by the Cyber Cafe 7* special "IP Tracing".


Issue: “bountiesplaced” and “totalbountyspent” (in personalstats)are public for anyone using the api. It’s possible to create a script to monitor these two stats on a large scale and matching changes to timestamps on anonymously received bounties, allowing the user of such script to narrow down the placer of an anonymous bounty down to the player behind the bounty. This mitigates the benefit of owning the SYS benefit block. There are several scrips in existence utilizing this flaw already.


Solution: Hide the value of “bountiesplaced” and “totalbountyspent” in the API if the player has the SYS benefit active.
Patient [2131539]
I get the reasoning behind this, but as long as the stats are available via the personal stats page, they should be available via API.

Similar scripts can be made for seeing who did a flight delay or an embargo, but like this hypothetical "figure out who did an anonymous bounty" script, there's no way for sure to know whether the person your script is telling you placed it is actually the person who did. At best it's an educated guess.

Also, wouldn't this necessitate hiding those stats on player profiles as well?