UWA changes its Echo360 configuration - no more wget, no more echo-proxy (for now)!

There was a lot of downtime for the Echo360 system this week.  What have UWA's IT crew been busy implementing?

This

A login page, which comes up the first time you try to view any lectures.  Hilariously, it refers to itself as a "security check".  I presume that it sets some kind of cookie, which then gets sent back to the UWA server when a request is made for mediacontent.m4v.  Because the thing is, the firefox extension will still work perfectly (you just need to log in at the above screen, after that, everything is as before)

Above: firefox extension, working, despite the "Security Check".  Lecture downloaded successfully. Hahaha >:-)

The only minor problem is that the update has broken echo-proxy (since it doesn't currently have any facilities for performing the log-in).  I'm also unable to use wget, for similar reasons (which is a shame, because wget made it easy to schedule my downloads for "off-peak" periods, which would have reduced UWA's server load).

In all honesty, it probably won't be too difficult to update echo-proxy to automatically get past the login page.  It will take a little bit of time to investigate how UWA have implemented everything, and then a bit of time to sidestep it, but I'm pretty certain it can be done (it's rather difficult to block people from accessing content which they have permission to access, lol).  Please be patient.  In the meantime, you can use firefox without issue.

As for using wget, curl will probably be a good alternative.  This shall require some investigation.

UPDATE: As it transpires, the system does indeed work by setting a cookie on the client side (called "ECP-HEMS-SESSION", contents indicates units which may be accessed, expires daily).  So dear Echo360 admins/developers, please understand the following:

When your "Security Check" relies solely on setting client side data (ie a cookie), that is no security at all.  Do you actually understand that I have complete control over the cookie that I send you? All you have done is create a trivially bypassed annoyance.  And to implement this annoyance, you took the system down for several days.  Well done, well done.