Hacker News new | ask | show | jobs
by LeifCarrotson 1271 days ago
Hopefully they didn't pay $millions...the source is completely unminified, it checks a cookie, calls Google Analytics, then changes the login link from display:none to display:block.

    function LoginButtonClick() {
        var selAccount = $("#accounts").val();
    
        LoginCookieSet(selAccount);
    
        if (typeof ga !== 'undefined')
            ga('techcu.send', 'event', 'button', 'Click', 'Member Login');
    
        var formAction = "https://online.techcu.com/User/AccessSignin/Password"; // testing url
    
        switch (selAccount) {
            case "1":
                formAction = "https://online.techcu.com/User/AccessSignin/Password";
                if (window.location.host === "dev.techcu.com" || window.location.host === "qa.techcu.com") {
                    formAction = "https://onlinetest.techcu.com/User/AccessSignin/Password";
                }
                break;
            case "3":
                formAction = "https://businessbanking.techcu.com/";
                break;
            case "2":
                formAction = "https://businessbanking.techcu.com/smallbusiness";
                break;
            default:
                formAction = "http://online.techcu.com/User/AccessSignin/Username";
        }
        if ($('#UsernameField1').val().substr(0, 2) == "**") {
            $('#onlineBankingLogin #UsernameField').val($('#UserNameHidden').val());
        } else {
            $('#onlineBankingLogin #UsernameField').val($('#UsernameField1').val());
        }
        $('#onlineBankingLogin #PasswordField').val($('#PasswordField1').val());
    
        $('#onlineBankingLogin').attr('action', formAction);
        $('#onlineBankingLogin').submit();
    }
The direct login link is then visible, you can bookmark https://online.techcu.com/User/AccessSignin/Start for later...but yeah, nonfunctional for ~10% of desktop browsers is not a good look for a technology credit union.
1 comments

Nice debugging and thanks! Didn't expect someone to actually dive in and figure it out. I'll bookmark the direct link to hold me over until I find a new bank but I've already totally lost confidence in the business. They can't even be assed to test their main web site. I wonder if they see the failure from analyzing the before-and-after browser share in their logs. I wonder if anyone's even monitoring the logs.