Passwords for JetBlue accounts cannot contain a Q or a Z

Post by avelis » Wed, May 14, 2014, 5:43 AM UTC

skizm wrote: post #56

Actually this kind of gives me an idea: what if modern systems decided to just tell people they can't use "p" so that people stop using the word "password" or variants as their password. Hell, for that matter, tell users they can't use vowels so they can't make words. They might do leet speak, or whatever which is pretty easy to crack given time, but it stops things like password re-use attacks (people less likely to…

Post by mct » Wed, May 14, 2014, 5:52 AM UTC

ryanburk wrote: post #60

seanmccann wrote: post #9

They use Sabre (like others), and it's an archaic holdover from when phones didn't have Qs or Zs.

I then wonder if these passwords are even less secure since the backend system would have mapped {A,B,C}=1 at some point for the dialer system to work. so my password "CaB" would be the same as "cab" and "CAB" and "ABC" and "111", etc.

Post by area51org » Wed, May 14, 2014, 6:17 AM UTC

MichaelGG wrote: post #117

area51org wrote: post #104

Earlier quoted context omitted.

Given the other strange, arbitrary restrictions we've seen in the wild over the years — no "special" characters, no longer than 12 characters, ad nauseum — my bet is that someone has it in his head that restricting the usable character set even further will somehow improve security. How, exactly, a rule like this improves security, I'm sure he cannot say, at least in a sensical way. Most of the time, these weird rule…

So Microsoft Live has a limit of 16 characters, ASCII and some other restrictions. I emailed someone that used to work on that team in a decently high capacity. He said it was a restriction in the original system, designed sometimes in the 90s, and that the password validation code is in several different places in the entire system (different products like Hotmail and so on). The char limit, well, they had to pick a…

Post by Velox » Wed, May 14, 2014, 6:30 AM UTC

ams6110 wrote: post #71

theboss wrote: post #51

Earlier quoted context omitted.

I don't know about that. Have a source? This is a pretty bad practice so I would be very surprised to see google doing this.

If you have a google apps account, and you create an account for a user (or adminstratively reset their password for them) they will get an email like: Hi Tina, You have a new account at Example Association. Your username is tsmith. Your initial password is ZjAdhUVC (you will need to change this when you log in). Your new email address is tsmith@example.com You can sign in to Example Association services at: http://w…

Post by chavesn » Wed, May 14, 2014, 6:36 AM UTC

eli wrote: post #88

Lagged2Death wrote: post #74

Earlier quoted context omitted.

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

Sure, maybe. But you're guessing at how the system works and how it's used and what the constraints are... Maybe Jetblue's developers a bunch of lazy dummies who couldn't think up the solution in your comment... But my experience suggests to me that they're much more likely to be perfectly competent and that there's simply more to the problem than is apparent from the outside.