jlouvel authored May 12, 2023 and Quentin Defenouillere committed Jun 01, 2023

We looked for a value written in french in a JSON response to add or not
the actual device as trusted. The value is now in english. Also added an
empty POST on a URL at the end of the login process to validate login.

jlouvel authored Apr 26, 2023 and Quentin Defenouillere committed May 02, 2023

OTP handling can still be needed for esalia. This OTP method was using
finalizing_login method which was removed when OTP handling wasn't
useful anymore. Also simplified it to be closer to what the website
does now. Plus, explained what a specific request after logging was
doing.

jlouvel authored Apr 20, 2023 and Quentin Defenouillere committed May 02, 2023

For a moment, we did not need to register our device. It seems now that
it's back for esalia. We can still login through erehsbc without having
to register any device.

kmartins authored Mar 22, 2023 and Romain Bignon committed Mar 28, 2023

esalia will inherit of erehsbc because
login are shared

kmartins authored Mar 22, 2023 and Romain Bignon committed Mar 28, 2023

It seems like we are now whitelisted and the
fingerprints process is outdated for our usage
if we try to do it, it lead us to a 403.

jlouvel authored Feb 27, 2023 and Romain Bignon committed Mar 04, 2023

'goto' is now found in a param and not in a fragment anymore.

Heddy authored Jul 17, 2022 and ntome committed Aug 08, 2022

end users can't retry sca with the
same otp because json_opt in state
is not saved after a wrongpass exception.
So we have to verify if otp_json exists.

Heddy authored Jun 24, 2022 and ntome committed Jul 07, 2022

Like s2e parent, we will add our browser like
trusted device to avoid systematic sca and
alert connection email.

jlouvel authored Apr 22, 2022 and hydrargyrum committed May 05, 2022

S2E children have all the exact same login except erehsbc which has now
a whole new login. The login is a javascript app so we need to mimic the
website as close as we can by encrypting the password and doing many
posts on the same URL to get different JSON callback responses. There's
an OTP because the website asks for the user to enter the code he has
received by email if the device connecting to the account is not a
trusted one. Everything after the login is left untouched.

All copyright holders have given their consent.