Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

41–50 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#41

Post by zibit »

eli wrote: post #26
mikeash wrote: post #22

Earlier quoted context omitted.

In this case, a legacy system (Sabre) whose origins predate the integrated circuit. I'm sure a lot has changed since then, but it's a bit scary to wonder what hasn't .

I don't find that scary. I think it's a testament to the original architects and to the people who maintain it.

It's nice to see these thoughts at the top of the thread. I get tired of hearing people in the security industry constantly smirking at "dump developers". They don't have a clue what it's like to develop real code with deadlines. They point fingers at others and call that an accomplishment.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#43

Post by [deleted] »

theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

[deleted]

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#44

Post by encoderer »

iopq wrote: post #33
theboss wrote: post #21

Earlier quoted context omitted.

I actually have no idea what you're talking about. All I know is they sent her plaintext passwords to her, which she redacted before sending to me....

oh, I thought it was actually PUT_PASSWORD_HERE placeholders it wasn't clear, you should have put black bars there

Agreed. I thought the same thing.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#47

Post by ams6110 »

theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

Google does the same thing, so I guess Jet Blue is in good company.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#48

Post by stephengillie »

When I saw the Sabre password requirements, I couldn't help but imagine that passwords are stored entirely numerically - "badpass" would be entered (hashed?) as "2237277", as in dialing a phone. So the password "abesass" would collide with "badpass" and grant access.

Has Sabre at least upgraded their storage mechanism, or do (did?) they reduce entropy on passwords?

Post reply on HN