Passwords for JetBlue accounts cannot contain a Q or a Z

Post by chris_wot » Wed, May 14, 2014, 9:51 AM UTC

jedberg wrote: post #112

Lagged2Death wrote: post #74

Earlier quoted context omitted.

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

How do you type your password into your telephone, something this system has to support? That's why you can't use Q and Z -- it's not on the phone.

Post by bela_lugosi » Wed, May 14, 2014, 10:14 AM UTC

wakeless wrote: post #148

roel_v wrote: post #145

Earlier quoted context omitted.

" then these processes have to be modernized" How so? So people can use Q's and Z's in their passwords? What would your business case look like? "Hey everybody let's spend $500 million so people can use arbitrary passwords, because [entropy], never mind most people use the name of their cat anyway?"

But my cat's name is quizzical.

Post by gcb0 » Wed, May 14, 2014, 11:15 AM UTC

dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

Post by eli » Wed, May 14, 2014, 11:44 AM UTC

chavesn wrote: post #129

eli wrote: post #88

Earlier quoted context omitted.

Sure, maybe. But you're guessing at how the system works and how it's used and what the constraints are... Maybe Jetblue's developers a bunch of lazy dummies who couldn't think up the solution in your comment... But my experience suggests to me that they're much more likely to be perfectly competent and that there's simply more to the problem than is apparent from the outside.

That's quite generous of you. I don't think there's any more reason to assume they are competent than to assume they aren't. The fact is that this sucks for the user. It's also a pretty safe bet to say that there are lots of developers putting code into use solving problems outside their competency. You may not want to assume this evidence makes them terrible developers, but that doesn't make the inverse any more lik…

Post by eloisant » Wed, May 14, 2014, 12:59 PM UTC

sqrt17 wrote: post #143

eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

Intuitively, the reason for forbidding Q and Z could be that those passwords can't be typed in blindly on QWERTZ and QZWERTY keyboards (which you're likely to find if you travel internationally). But then they'd have to be consequent and also forbid Y and maybe A.