Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

11–20 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#11
They also can't contain symbols (so apparently just digits and letters except Q and Z). The combination suggests to me the horrible possibility that they actually reduce the password to just digits for storage, and to support entry on devices that look like old touchtone phones [1] (I say "old" because newer ones usually have "PQRS" instead of "PRS" and "WXYZ" instead of "WXY"):

[1] Like: http://www.cs.utexas.edu/users/scottm/cs307/utx/assignment5....

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#12

They use Sabre (like others), and it's an archaic holdover from when phones didn't have Qs or Zs.

Today, I learned that phones didn't have Qs or Zs. Things you don't notice on that one rotary phone your parents used to have when you were 5.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#13
That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue.

First this screenshot: http://i.imgur.com/oKKpFM1.png

Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png

She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#15
post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

Did you tell her to make sure that password isn't used anywhere else?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#16
post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

It's worth noting that when you say "venerable" you mean it. Basic research for what would become Sabre first started in 1953, development started in earnest in 1957, and it was online in 1960.

It's also interesting that the project got its start because an IBM salesman just happened to be sitting next to the president of American Airlines on a flight, and that salesman happened to be working on a massive air defense computer system for the Air Force. Goes to show the power of knowing the right people, or in this case, coincidentally meeting them on a plane.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#17
post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

oh come on, man

everyone's sent those emails before you try to do some smart templating, but your designer changes the template and never actually remembers that those were FILLER VALUES

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#19
post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

Did you tell her to make sure that password isn't used anywhere else?

She's a computer person too so she knows all this jazz.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#20
I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem.

I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the evolution.

Post reply on HN