Question: Can you please make it optional to provide an API key ?

[AndroidDeveloperLB]

1. The repository main page doesn't say why it's needed: https://github.com/SamuelTulach/VirusTotalUploader

2. It wasn't needed in the past, as I remember.

3. The website seems to allow to upload freely and even without a file-size restriction: https://www.virustotal.com/gui/home/upload

4. The deprecated tool still allows to upload freely (with size restriction, but still...) : https://support.virustotal.com/hc/en-us/articles/115002179065-Desktop-Apps#windows-uploader

5. ProcessExplorer tool doesn't require you to set an API key, and it scans all processes...: https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

What does having a key provide the app, that without it, it's impossible? What are the advantages? Are there disadvantages (privacy, for example) ?

Can you please make it optional, and just show that it's required if the user tries to do more than is allowed without a key? Then you can also provide this information, of why the user needs it, and how to get it.

[tnhung2011]

You can find the reason here (please click Example (401)).

[AndroidDeveloperLB]

@tnhung2011 How does the old app work, and how can ProcessExplorer work?

[AndroidDeveloperLB]

I didn't ask these questions to a specific user.

[SamuelTulach]

As the documentation says, you need an API key to interact with the API. Both tools you linked are most probably using their own dedicated API key. I could try to reverse engineer it or look it up, but that might be against VT TOS. If anyone has more information about it, I would be glad.

[AndroidDeveloperLB]

@SamuelTulach Even uploading via the website? Couldn't there be an option "upload via website" so that it opens there and upload there? After all, the result is shown on the same website anyway, so what's the difference between having a UI of a progress bar, and going to the website and upload the file? It could be just a more convenient way to upload via the website this way...

[SamuelTulach]

Primarily having the option to just right click and upload. The API is the official way to interact with VT when you want to use any automation tools/desktop apps. So sadly using the website directly could also be against TOS... I am gonna look into the ProcessExplorer to see if I can log the key from the network traffic or something since their EULA quite literally does not mention VT at all.

[SamuelTulach]

It took me longer to get to my PC then to actually find the ProcessExplorer API key.

4e3202fdbe953d628f650229af5b3eb49cd46b2d3bfe5546ae3c5fa48b554e0c

All that was needed for a simple HTTP logging session (their EULA does disallow disassembly or decompilation which this is not). Of course the question is if I can put the API key in the uploader. Technically their ToS does not state anything about using someone elses key and this key is basically public given the fact it's in ProcessExplorer...

[AndroidDeveloperLB]

Could you please add an option to just direct to the website, uploading the file, in case it's a single file, then? This way it's irrelevant to automation, as it's a single file. Most of the time, when I use this tool (virus-total-uploader), I upload a single file.

BTW, the key seems to work well. Thank you

[SamuelTulach]

Not sure what you mean by that. In the settings there is a "direct upload" option and you can right click -> send to -> VT uploader to upload the single file. This will be moved on top of the context menu in the next release because people are apparently used to every single program bloating their menus.

[AndroidDeveloperLB]

I mean that you can have an embedded web-browser component in the app to upload the file, just like a user would do it. Or you could have an addon for web browsers that will allow this app to communicate with it. Or any other workaround that will use the website instead of using an API.

[SamuelTulach]

I was trying to say that it's not the smartest idea to implement something like this since VT explicitly states that if you want to use it in desktop programs you need to use their API.

There would be no need to embed anything you could just send the request directly with a bit of web debugging.

If it was allowed to do so, I would just make an electron app that could be crossplatform and embed their site into it (+ add context menu for faster uploads).

I would probably need a permission from VirusTotal to do that, but I doubt that I will be allowed to do so, since VT does not want to "replace" and AV programs. It's purpose is to have a simple online scanner, a paid service for enterprises (for example mail scanning, malware tracking) and to report feedback to AV vendors (that's why I believe they don't want to have standalone desktop client since that could theoretically be a competition for them).

[SamuelTulach]

This is how an electron client could look. Maybe adding something like DarkReader to the mix to make it dark would not be bad.

Unfortunately the use like this is simply not very clear (I am not sure if that's allowed or nah).

[AndroidDeveloperLB]

Cool

[D0LLYNH0]

@tnhung2011 How does the old app work, and how can ProcessExplorer work?

I checked, the call is identical to the "VirusTotalUploader", the only difference is that the old application uses a predefined API key.

[AndroidDeveloperLB]

@D0LLYNH0 So I guess that at least for private use, it's ok to use this API key, especially if I already have Process Explorer installed... Right?