Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

141–150 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#141

Post by hellerbarde »

ubernostrum wrote: post #131
SomeCallMeTim wrote: post #126

Earlier quoted context omitted.

"Type your password into your telephone"; already they're asking me to do the wrong thing. If my password is anywhere near secure, then typing it into a phone would be a nightmare. A combination of 16 numbers and letters that I need to convert to numbers? I'd be pressing zero and hoping for an operator before I even opened up my password vault to find the secure password to begin with. If you want a phone interface,…

already they're asking me to do the wrong thing Now, yes. The original SABRE dates back to the 1950s, and was not an airline-customer-facing system; SABRE dates to an era when the phone interface was used by airline ticket agents. So if you're going to argue that the design is wrong, you need to argue for why it was wrong for the 1950s use case and interaction patterns, not try to retrofit 2014's use cases and intera…

The architecture might have been state of the art and completely reasonable back in "ye olden days". The fact remains that it's not appropriate for 2014.

If the reasons for this behemoth are compatibility with 50 years old processes, then these processes have to be modernized so this software can be scrapped. (or fixed, either way a huge project)

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#142

Post by vidarh »

gress wrote: post #81
mikeash wrote: post #30

Earlier quoted context omitted.

No doubt. Interestingly, this meeting didn't happen on a jet and probably predates the term "jet set", as the first jet airliner had only entered service the year before. The IBM salesman thinks it might have been a DC-6: http://conservancy.umn.edu/bitstream/11299/107637/1/oh034rbs... Interesting little note from that: "I learned later that he would be sitting in his office in New York and he'd suddenly wonder how th…

I know of British Airways executives who flew from London to New York on Concorde only to attend meetings from which they returned again the same day without having left the airport.

I've done Heathrow -> Dulles -> meeting in Sterling, VA -> Dulles -> Heathrow same day. It's not fun, but it's also not that unusual, even without the Concorde.

UK -> US east coast works reasonably well that way, given that the flight is 5-6 hours, and 5 hour time difference, so you can get on a flight early morning from London, arrive early morning at the east coast, have your meeting and catch an evening flight back out which'll arrive back in the UK in the morning local time.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#143

Post by sqrt17 »

eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

Intuitively, the reason for forbidding Q and Z could be that those passwords can't be typed in blindly on QWERTZ and QZWERTY keyboards (which you're likely to find if you travel internationally). But then they'd have to be consequent and also forbid Y and maybe A.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#144

Post by Fuxy »

gaius wrote: post #133
SomeCallMeTim wrote: post #126

Earlier quoted context omitted.

"Type your password into your telephone"; already they're asking me to do the wrong thing. If my password is anywhere near secure, then typing it into a phone would be a nightmare. A combination of 16 numbers and letters that I need to convert to numbers? I'd be pressing zero and hoping for an operator before I even opened up my password vault to find the secure password to begin with. If you want a phone interface,…

Yeah, call me when you've got some code running in production for 60 years. Kids these days...

There's a reason we invented the term bit rot and this is probably one of the reason only in this case the code works perfectly fine it's just the entire use case that is outdated.

Instead of bringing the code into 2014 they would bring the world into the 1950's.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#145

Post by roel_v »

hellerbarde wrote: post #141
ubernostrum wrote: post #131

Earlier quoted context omitted.

already they're asking me to do the wrong thing Now, yes. The original SABRE dates back to the 1950s, and was not an airline-customer-facing system; SABRE dates to an era when the phone interface was used by airline ticket agents. So if you're going to argue that the design is wrong, you need to argue for why it was wrong for the 1950s use case and interaction patterns, not try to retrofit 2014's use cases and intera…

The architecture might have been state of the art and completely reasonable back in "ye olden days". The fact remains that it's not appropriate for 2014. If the reasons for this behemoth are compatibility with 50 years old processes, then these processes have to be modernized so this software can be scrapped. (or fixed, either way a huge project)

" then these processes have to be modernized"

How so? So people can use Q's and Z's in their passwords? What would your business case look like? "Hey everybody let's spend $500 million so people can use arbitrary passwords, because [entropy], never mind most people use the name of their cat anyway?"

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#146

Post by phlo »

As many sources have pointed, out, this is very likely related to Sabre. Interestingly, there is another reason why such a restriction might be useful:

There are three popular key arrangements. English/US QWERTY, French AZERTY, and German QWERTZ. Apart from switching around A, W, Y, Z, and most special characters, they are mostly identical.

If your goal is to ensure successful password entry even if a user is unexpectedly using an unfamiliar keyboard scheme, all you need to do is replace all instances of A or Q by one value; and all instances of W, Y, Z by another. Or you could, of course, disallow these characters.

I hear Facebook had a similar approach to coping with input problems in the early days of mobile access: for each passWord1, three hashes were stored: "PassWord1" (uppercase first letter), "PASSwORD1" (caps lock) and "passWord1" (unchanged). As far as I remember, they didn't deal with i18n issues -- or publish the results of their approach.

Edit: This would, of course, weaken password security significantly. If my very rough back-of-the-envelope calculation is correct, by a bit less than 50%.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#148

Post by wakeless »

roel_v wrote: post #145
hellerbarde wrote: post #141

Earlier quoted context omitted.

The architecture might have been state of the art and completely reasonable back in "ye olden days". The fact remains that it's not appropriate for 2014. If the reasons for this behemoth are compatibility with 50 years old processes, then these processes have to be modernized so this software can be scrapped. (or fixed, either way a huge project)

" then these processes have to be modernized" How so? So people can use Q's and Z's in their passwords? What would your business case look like? "Hey everybody let's spend $500 million so people can use arbitrary passwords, because [entropy], never mind most people use the name of their cat anyway?"

But my cat's name is quizzical.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#149

Post by mhandley »

phlo wrote: post #146

As many sources have pointed, out, this is very likely related to Sabre. Interestingly, there is another reason why such a restriction might be useful: There are three popular key arrangements. English/US QWERTY, French AZERTY, and German QWERTZ. Apart from switching around A, W, Y, Z, and most special characters, they are mostly identical. If your goal is to ensure successful password entry even if a user is unexpec…

Seems more likely that Sabre's restriction was because old phone dials (and the keypads that replaced them) didn't have Q or Z:

http://payphonepictures.com/44631-4/IMG_4953.jpg http://www.dreamstime.com/royalty-free-stock-photography-pay...

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#150

Post by kirab »

For everyone who designs password rules: Please do not require the password to contain uppercase, lowercase letter, numbers and so on. Because this actually makes passwords statistically easier guessable. The only thing you should require is a minimum length, I recommend at least 10, better 12 characters. Even 12 digits are more secure than say "Apple1".
Post reply on HN