Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

131–140 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#131

Post by ubernostrum »

SomeCallMeTim wrote: post #126
jedberg wrote: post #112

Earlier quoted context omitted.

How do you type your password into your telephone, something this system has to support? That's why you can't use Q and Z -- it's not on the phone.

"Type your password into your telephone"; already they're asking me to do the wrong thing. If my password is anywhere near secure, then typing it into a phone would be a nightmare. A combination of 16 numbers and letters that I need to convert to numbers? I'd be pressing zero and hoping for an operator before I even opened up my password vault to find the secure password to begin with. If you want a phone interface,…

already they're asking me to do the wrong thing

Now, yes.

The original SABRE dates back to the 1950s, and was not an airline-customer-facing system; SABRE dates to an era when the phone interface was used by airline ticket agents.

So if you're going to argue that the design is wrong, you need to argue for why it was wrong for the 1950s use case and interaction patterns, not try to retrofit 2014's use cases and interaction patterns onto it.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#132

Post by taejo »

8_hours_ago wrote: post #52
stephengillie wrote: post #48

When I saw the Sabre password requirements, I couldn't help but imagine that passwords are stored entirely numerically - "badpass" would be entered (hashed?) as "2237277", as in dialing a phone. So the password "abesass" would collide with "badpass" and grant access. Has Sabre at least upgraded their storage mechanism, or do (did?) they reduce entropy on passwords?

I was also curious about this and decided to test it. I created a new account with the password "badpassbadpass" (minimum password length of 8!), but I was unable to log in with "abesassabesass". There was also no error when I tried to put a 'q' and a 'z' in my password, so I'm guessing that they've updated their system since the documentation was written.

It's possible they store both the original password, for use on the web, and the numeric version, for phones.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#133

Post by gaius »

SomeCallMeTim wrote: post #126
jedberg wrote: post #112

Earlier quoted context omitted.

How do you type your password into your telephone, something this system has to support? That's why you can't use Q and Z -- it's not on the phone.

"Type your password into your telephone"; already they're asking me to do the wrong thing. If my password is anywhere near secure, then typing it into a phone would be a nightmare. A combination of 16 numbers and letters that I need to convert to numbers? I'd be pressing zero and hoping for an operator before I even opened up my password vault to find the secure password to begin with. If you want a phone interface,…

Yeah, call me when you've got some code running in production for 60 years. Kids these days...

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#134

Post by dasil003 »

maccard wrote: post #120
gress wrote: post #81

Earlier quoted context omitted.

I know of British Airways executives who flew from London to New York on Concorde only to attend meetings from which they returned again the same day without having left the airport.

Granted, I'm not in the same boat as exec's, but I'm a student and have had dealings with people from other universities in the UK (I'm irish), and I have flown, met them in airport hotels, and flown home same day or first flight following morning.

Yeah but New York => LA is over 5 hours. Is there any flight from Ireland to the UK that takes more than 1:30?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#135

Post by seabee »

maccard wrote: post #120
gress wrote: post #81

Earlier quoted context omitted.

I know of British Airways executives who flew from London to New York on Concorde only to attend meetings from which they returned again the same day without having left the airport.

Granted, I'm not in the same boat as exec's, but I'm a student and have had dealings with people from other universities in the UK (I'm irish), and I have flown, met them in airport hotels, and flown home same day or first flight following morning.

Flying UK-Ireland takes less time than most intercity train journeys, so that is not surprising.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#136

Post by vacri »

growupkids wrote: post #68
theboss wrote: post #34

Earlier quoted context omitted.

Oh yeah. It's impossible to know who has your plaintext password on the backend (even steam who RSA encrypts your pw with a public key before sending), but this certainly is a bad practice and certainly makes it look like they do not have robust security practices.

Or too many end users that forget their passwords. Never underestimate the costs of supporting password resets for nontechnical users.

This is a sentiment often missed by the security community. Good security is good to have, but if it makes the service unusable, it's worthless. And when it comes to the general public, that's a low bar set. Banking PIN codes are laughably poor security, but in general they do quite a reasonable job - people get their banking done, and the banks haven't collapsed in a heap due to PIN-based security violations.

This being said, the banks are also in the unusual position of being able to effectively insure themselves against relatively small losses (to them) in order to keep confidence in their business high.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#137

Post by mentat »

squeaky-clean wrote: post #82
8_hours_ago wrote: post #52

Earlier quoted context omitted.

I was also curious about this and decided to test it. I created a new account with the password "badpassbadpass" (minimum password length of 8!), but I was unable to log in with "abesassabesass". There was also no error when I tried to put a 'q' and a 'z' in my password, so I'm guessing that they've updated their system since the documentation was written.

I just tried it with 'abcabcabc' as my password. It claims passwords are case sensitive, but both 'abcabcabc' and 'ABCABCABC' work and any variation ('ABCabcaBc' works). Variations based on a phone pad don't seem to work. '123123123' or 'bacbacbac' don't work. I also tried only changing one letter. >Must contain one letter and one number Also not true. >Cannot contain three repeating character Also not true. I change…

So for all those saying that we should just "trust the engineers know what they're doing" this is a pretty damning refutation as far as I'm concerned.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#138

Post by dasil003 »

michaelmior wrote: post #122
drdeadringer wrote: post #12

Earlier quoted context omitted.

Today, I learned that phones didn't have Qs or Zs. Things you don't notice on that one rotary phone your parents used to have when you were 5.

Or the rotary phone your parents still have right now in my case.

Or the antique Bell candlestick rotary phone that my mom has, still hard-wired into a phone nook inset into the plaster walls during construction nearly 100 years ago. And that bad boy still works flawlessly.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#139

Post by vacri »

ams6110 wrote: post #71
theboss wrote: post #51

Earlier quoted context omitted.

I don't know about that. Have a source? This is a pretty bad practice so I would be very surprised to see google doing this.

If you have a google apps account, and you create an account for a user (or adminstratively reset their password for them) they will get an email like: Hi Tina, You have a new account at Example Association. Your username is tsmith. Your initial password is ZjAdhUVC (you will need to change this when you log in). Your new email address is tsmith@example.com You can sign in to Example Association services at: http://w…

(you will need to change this when you log in)

That's 'will need' not 'we ask nicely and you can ignore'. When you create a user, it gives the option of setting their password for them, or using a temporary password, which they have to change.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#140

Post by vacri »

stephengillie wrote: post #77
daviding wrote: post #57

Earlier quoted context omitted.

psswrd123

assword123

Looking through old scripts, you'll sometimes see a matching query for "sername", so you get both Username and username (pseudo case-insensitive) and there's usually a second matching query for... "ssword", because removing "P" gives you "assword", which clearly is improper to put in a script! Harrumph!
Post reply on HN