Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

81–90 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#81

Post by gress »

mikeash wrote: post #30
fiatmoney wrote: post #23

Earlier quoted context omitted.

Less of a coincidence when flying was expensive enough to be reserved for the "jet set".

No doubt. Interestingly, this meeting didn't happen on a jet and probably predates the term "jet set", as the first jet airliner had only entered service the year before. The IBM salesman thinks it might have been a DC-6: http://conservancy.umn.edu/bitstream/11299/107637/1/oh034rbs... Interesting little note from that: "I learned later that he would be sitting in his office in New York and he'd suddenly wonder how th…

I know of British Airways executives who flew from London to New York on Concorde only to attend meetings from which they returned again the same day without having left the airport.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#82

Post by squeaky-clean »

8_hours_ago wrote: post #52
stephengillie wrote: post #48

When I saw the Sabre password requirements, I couldn't help but imagine that passwords are stored entirely numerically - "badpass" would be entered (hashed?) as "2237277", as in dialing a phone. So the password "abesass" would collide with "badpass" and grant access. Has Sabre at least upgraded their storage mechanism, or do (did?) they reduce entropy on passwords?

I was also curious about this and decided to test it. I created a new account with the password "badpassbadpass" (minimum password length of 8!), but I was unable to log in with "abesassabesass". There was also no error when I tried to put a 'q' and a 'z' in my password, so I'm guessing that they've updated their system since the documentation was written.

I just tried it with 'abcabcabc' as my password. It claims passwords are case sensitive, but both 'abcabcabc' and 'ABCABCABC' work and any variation ('ABCabcaBc' works). Variations based on a phone pad don't seem to work. '123123123' or 'bacbacbac' don't work. I also tried only changing one letter.

>Must contain one letter and one number

Also not true.

>Cannot contain three repeating character

Also not true. I changed my password to 'qqq123123' and could login just fine. Something like 'zzz123123' does not work.

I put way too much effort into this.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#83

Post by jonknee »

mikeash wrote: post #30
fiatmoney wrote: post #23

Earlier quoted context omitted.

Less of a coincidence when flying was expensive enough to be reserved for the "jet set".

No doubt. Interestingly, this meeting didn't happen on a jet and probably predates the term "jet set", as the first jet airliner had only entered service the year before. The IBM salesman thinks it might have been a DC-6: http://conservancy.umn.edu/bitstream/11299/107637/1/oh034rbs... Interesting little note from that: "I learned later that he would be sitting in his office in New York and he'd suddenly wonder how th…

> I doubt many company presidents are taking that sort of approach anymore.

That's why they buy a jet with company money now.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#84

Post by jonknee »

grmarcil wrote: post #72
hamiltonkibbe wrote: post #53

Earlier quoted context omitted.

Charles Schwab silently truncates passwords to 8 characters. Always a fun surprise to accidentally enter a password you use somewhere else and get logged in anyways.

I complained to them a while ago about the fact that they limit passwords to 8 characters. Must have been two years ago and I got a very generic "sorry, we know this could be better and our engineers are working on it. In the mean time, we'll send you an RSA security token fob for two factor authentication if you'd like". Thanks but no thanks, I'd rather not add another item to my keychain to make up for your website…

> Thanks but no thanks, I'd rather not add another item to my keychain to make up for your website's lackluster password requirements.

If you care about keeping your money it may be wise to take the fob and/or find a new bank/broker.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#86

Post by cbsmith »

Alupis wrote: post #38
eli wrote: post #26

Earlier quoted context omitted.

I don't find that scary. I think it's a testament to the original architects and to the people who maintain it.

It's 2014. Passwords need to be treated as a serious matter. Legacy system or not, there is no good reason to reduce keyspace. As others have mentioned, this is a sign that passwords are being made compatible with old phones without these letters available... and likely the passwords being reduced to numbers before storage. The prohibition of special characters also seems to corroborate this. Furthermore, the poster…

Honestly, if you add one extra digit/character to the password, that more than compensates for the loss of Q & Z. There are lots of circumstances where being able to work with legacy phone systems effortlessly would be most helpful. If you are taking passwords seriously, this might be the very last thing you worry about.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#87

Post by Iterated »

Question to all those saying this is because of Sabre:

How? Does the TrueBlue password somehow go through Sabre's systems? The truly old business unit of Sabre that everyone is referencing is Travel Network. I'm not sure why an airline's loyalty program would intersect with Travel Network other than through the back end of a booking tool.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#88

Post by eli »

Lagged2Death wrote: post #74
eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

Sure, maybe. But you're guessing at how the system works and how it's used and what the constraints are...

Maybe Jetblue's developers a bunch of lazy dummies who couldn't think up the solution in your comment... But my experience suggests to me that they're much more likely to be perfectly competent and that there's simply more to the problem than is apparent from the outside.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#89

Post by 1stop »

Lagged2Death wrote: post #74
eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

What if the legacy system underneath IS the hashing system?
Post reply on HN