Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

31–40 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#31

Post by 30thElement »

jamieomatthews wrote: post #2

Can anyone explain why this is? I've never heard a security reason for this.

While the other answers about Sabre are probably right, I've heard that banks intentionally have stupid password policies to prevent password reuse. If one bank says "no special characters but most contain a number", another says "must contain a special character, but no numbers", and a 3rd says "must contain a number and special character", they can guarantee that if one of the 3 is hacked into it doesn't compromise people with accounts at all 3 (of course ignoring people using "password" with a 1 or ! on the end).

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#32

Post by SnakeDoc »

theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

WOW! It's 2014, developers need to take credentials seriously. There is no excuse.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#33

Post by iopq »

theboss wrote: post #21
iopq wrote: post #17

Earlier quoted context omitted.

oh come on, man everyone's sent those emails before you try to do some smart templating, but your designer changes the template and never actually remembers that those were FILLER VALUES

I actually have no idea what you're talking about. All I know is they sent her plaintext passwords to her, which she redacted before sending to me....

oh, I thought it was actually PUT_PASSWORD_HERE placeholders it wasn't clear, you should have put black bars there

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#34

Post by theboss »

rallison wrote: post #29
theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

While I can't stand passwords sent as part of a welcome email, this does not actually mean that they store the passwords in plaintext. Often, companies will send the username and password as part of a welcome email upon the user registering (and the above screenshots look exactly like that). This does not preclude the company from then hashing the password and storing it hashed. That said, it still is a terrible prac…

Oh yeah. It's impossible to know who has your plaintext password on the backend (even steam who RSA encrypts your pw with a public key before sending), but this certainly is a bad practice and certainly makes it look like they do not have robust security practices.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#35

Post by pattern »

theboss wrote: post #21
iopq wrote: post #17

Earlier quoted context omitted.

oh come on, man everyone's sent those emails before you try to do some smart templating, but your designer changes the template and never actually remembers that those were FILLER VALUES

I actually have no idea what you're talking about. All I know is they sent her plaintext passwords to her, which she redacted before sending to me....

Since your friend redacted the emails with the same font/color as the email itself, it wasn't clear to the parent commenter what had happened, and they (likely) assumed you were pointing out the existence of the placeholders.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#36

Post by eddieroger »

eli wrote: post #26
mikeash wrote: post #22

Earlier quoted context omitted.

In this case, a legacy system (Sabre) whose origins predate the integrated circuit. I'm sure a lot has changed since then, but it's a bit scary to wonder what hasn't .

I don't find that scary. I think it's a testament to the original architects and to the people who maintain it.

I'm not sure about that. Sabre is an extremely (assumption) functional tool in an extremely niche market. That makes the barrier to enter it very high, and the barrier to rewrite equally so. Underneath the covers it could be a real piece hung together by duct tape and vacuum tubes, but why rewrite it if it's working and keeping planes in the air?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#38

Post by Alupis »

eli wrote: post #26
mikeash wrote: post #22

Earlier quoted context omitted.

In this case, a legacy system (Sabre) whose origins predate the integrated circuit. I'm sure a lot has changed since then, but it's a bit scary to wonder what hasn't .

I don't find that scary. I think it's a testament to the original architects and to the people who maintain it.

It's 2014. Passwords need to be treated as a serious matter. Legacy system or not, there is no good reason to reduce keyspace. As others have mentioned, this is a sign that passwords are being made compatible with old phones without these letters available... and likely the passwords being reduced to numbers before storage. The prohibition of special characters also seems to corroborate this.

Furthermore, the poster below who showed screenshots of being emailed their password indicates JetBlue is storing passwords either in plain-text, or encrypting them (both just as bad), instead of properly cryptographically hashing before storage.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#39

Post by jmcgough »

iopq wrote: post #17
theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

oh come on, man everyone's sent those emails before you try to do some smart templating, but your designer changes the template and never actually remembers that those were FILLER VALUES

those are redactions that were edited into the image - the original had the actual information in it

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#40

Post by Rizz »

jkubicek wrote: post #27
slaundy wrote: post #14

I just changed my Jetblue password to contain both a Q and a Z. Seems the support documentation is out of date.

Have you tried logging in with the same password, minus the Q and Z?

Or with different characters that are keyed with the same digit on a phone, like P, R or S for the Q?
Post reply on HN