Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

111–120 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#111

Post by dredmorbius »

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad.

What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system, SABRE, is one of the oldest widely-used public-facing computer systems still in existence, dating to the 1950s.

https://en.wikipedia.org/wiki/Sabre_(computer_system)

The 7/9 standard, by the way comes from the international standard ITU E 1.161, also known as ANSI T1.703-1995/1999 and ISO/IEC 9995-8:1994).

http://www.dialabc.com/words/history.html

Other keypads may not assign Q or Z at all, or assign it to various other numbers, 1 for Australian Classic, 0 for UK Classic and Mobile 1.

http://www.dialabc.com/motion/keypads.html

Similarly, special characters can be entered via numerous mechanisms on phone keyboards.

My suspicion is that there's a contractual requirement somewhere to retain compatibility with an existing infrastructure somewhere.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#112

Post by jedberg »

Lagged2Death wrote: post #74
eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

How do you type your password into your telephone, something this system has to support?

That's why you can't use Q and Z -- it's not on the phone.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#114

Post by dredmorbius »

coldcode wrote: post #92
mikeash wrote: post #22

Earlier quoted context omitted.

In this case, a legacy system (Sabre) whose origins predate the integrated circuit. I'm sure a lot has changed since then, but it's a bit scary to wonder what hasn't .

I doubt that the passwords come from SABRE. There is a lot of stuff between the front end and SABRE. I expect Jet Blue manages their own systems that only call SABRE internally.

I interviewed with an airline in the past few years for a project involving migrating its reservations and management systems (interesting tidbit: both maintenance and reservations were tied to the same underlying system). And integration with SABRE was very much a part of the job req.

I passed largely as it seemed that there were some significant organizational issues and wrestling with 60 year old computer systems stopped being my definition of fun a while ago. There were some glitches in the rollout but they got things running by and by.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#115

Post by dredmorbius »

ateeqs wrote: post #108
lectrick wrote: post #105

Earlier quoted context omitted.

No. If there is a bizarre password restriction like this, it is almost certainly because they are storing the password in cleartext somewhere (bad) or because they expect users to be able to enter the password in via a telephone keypad, which vastly reduces the number of possible combinations since every number substitutes for 3-4 letters (also bad).

I suspect that this is the likely answer here, since old telephone keypads did not have Q and Z.

And more recent keypads have assigned various characters (particularly Q & Z) inconsistently, as I've posted separately.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#116

Post by dredmorbius »

skizm wrote: post #56

Actually this kind of gives me an idea: what if modern systems decided to just tell people they can't use "p" so that people stop using the word "password" or variants as their password. Hell, for that matter, tell users they can't use vowels so they can't make words. They might do leet speak, or whatever which is pretty easy to crack given time, but it stops things like password re-use attacks (people less likely to…

Better to simply utilize one of the many, many, many, many, many lists of most frequently used passwords.

There are lists extending to the tens of thousands if not millions, but simply forbidding the 10 or 100 most frequent combinations would be a huge win. Using full lists as available would be great -- and is actually what password security should be based around. A known password is a bad password.

Don't get me started on PINs.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#117

Post by MichaelGG »

area51org wrote: post #104
Lagged2Death wrote: post #74

Earlier quoted context omitted.

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

Given the other strange, arbitrary restrictions we've seen in the wild over the years — no "special" characters, no longer than 12 characters, ad nauseum — my bet is that someone has it in his head that restricting the usable character set even further will somehow improve security. How, exactly, a rule like this improves security, I'm sure he cannot say, at least in a sensical way. Most of the time, these weird rule…

So Microsoft Live has a limit of 16 characters, ASCII and some other restrictions. I emailed someone that used to work on that team in a decently high capacity. He said it was a restriction in the original system, designed sometimes in the 90s, and that the password validation code is in several different places in the entire system (different products like Hotmail and so on).

The char limit, well, they had to pick a limit (you wouldn't want passwords of 2^32 size), and back then security wasn't as big a focus so someone picked 16.

The reason for the original restriction is lost to history, as is apparently the handling of special chars. It may have been as simple as someone piping something to a shell script to setup an account, and not escaping things correctly. Who knows.

At any rate, Live has some extremely competent engineers, and this guy is brilliant. He said despite how bad it looks, every time they review security and prioritize things to work on, the password restrictions on Live never rank very high, compared to other attacks. People simply are not having their passwords brute forced enough for it to be a serious issue. Investing in things like e.g., detecting phishing attempts, has a much better ROI.

eli's comment is right: You shouldn't be too quick to judge the quality of developers when they need to maintain compatibility. At best, you might find out that a developer from a long time ago, operating under who knows what constraints (time, technical), failed to properly foresee the usage of his system.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#118

Post by dredmorbius »

jfoster wrote: post #54

If they were OK with applying more duct tape, why not map Q and Z to characters (eg. A and B) that can be part of passwords? (eg. a password of "quiz" would become "auib") It would make their password system slightly weaker perhaps, since freq(a) then becomes more like freq(a)+freq(q) and freq(b) more like freq(b)+freq(z). I'm not sure that's much weaker than just excluding Q and Z, though. The user experience is imp…

At the time the underlying system was designed, Q and Z weren't mapped.

Subsequently they were mapped, but inconsistently across phonesets.

The ITU E 1.161 / ANSI T1.703-1995/1999 / ISO/IEC 9995-8:1994 standard didn't become established until relatively recently. Guessing from the nomnclature, I'd assume subsequent to 1995 / 1999.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#119

Post by woebtz »

na85 wrote: post #90
Sami_Lehtinen wrote: post #85

My bank allows only passwords which are six digits like 123456. No longer or other characters or symbols.

Find a new bank. Tell your bank why you switched.

My bank only allows email addresses less than 31 characters in length. I filed a bug report and received a, "thanks, we know..." Fortunately, their password policy isn't as ridiculous.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#120

Post by maccard »

gress wrote: post #81
mikeash wrote: post #30

Earlier quoted context omitted.

No doubt. Interestingly, this meeting didn't happen on a jet and probably predates the term "jet set", as the first jet airliner had only entered service the year before. The IBM salesman thinks it might have been a DC-6: http://conservancy.umn.edu/bitstream/11299/107637/1/oh034rbs... Interesting little note from that: "I learned later that he would be sitting in his office in New York and he'd suddenly wonder how th…

I know of British Airways executives who flew from London to New York on Concorde only to attend meetings from which they returned again the same day without having left the airport.

Granted, I'm not in the same boat as exec's, but I'm a student and have had dealings with people from other universities in the UK (I'm irish), and I have flown, met them in airport hotels, and flown home same day or first flight following morning.
Post reply on HN