Passwords for JetBlue accounts cannot contain a Q or a Z • Hacker News Board

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#171

Post by colanderman » Wed, May 14, 2014, 2:52 PM UTC

gcb0 wrote: post #155

dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

so, they have a requirement to maintain compatibility with telephone password input, but require an uppercase character as well? it does not make any sense. this is incompetent developers in a dysfunctional environment. there is no good light anyone can throw at it. and no, having the system live since the 50s is not a good excuse. it is certainly not the same system, for obvious reason.

That makes perfect sense. 'A' and 'a' are both on the 2 key, along with 'b', 'c', 'B', and 'C'.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#172

Post by hamiltonkibbe » Wed, May 14, 2014, 2:57 PM UTC

grmarcil wrote: post #72

hamiltonkibbe wrote: post #53

Earlier quoted context omitted.

Charles Schwab silently truncates passwords to 8 characters. Always a fun surprise to accidentally enter a password you use somewhere else and get logged in anyways.

I complained to them a while ago about the fact that they limit passwords to 8 characters. Must have been two years ago and I got a very generic "sorry, we know this could be better and our engineers are working on it. In the mean time, we'll send you an RSA security token fob for two factor authentication if you'd like". Thanks but no thanks, I'd rather not add another item to my keychain to make up for your website…

The only situation I could imagine it weakening the system is if your non-dictionary-word password can be turned into a dictionary word by adding several characters on to the end.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#173

Post by dreamfactory2 » Wed, May 14, 2014, 2:58 PM UTC

Fuxy wrote: post #144

gaius wrote: post #133

Earlier quoted context omitted.

Yeah, call me when you've got some code running in production for 60 years. Kids these days...

There's a reason we invented the term bit rot and this is probably one of the reason only in this case the code works perfectly fine it's just the entire use case that is outdated. Instead of bringing the code into 2014 they would bring the world into the 1950's.

i guess requirement rot is partly why we have agile

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#174

Post by drdeadringer » Wed, May 14, 2014, 3:01 PM UTC

michaelmior wrote: post #122

drdeadringer wrote: post #12

Earlier quoted context omitted.

Today, I learned that phones didn't have Qs or Zs. Things you don't notice on that one rotary phone your parents used to have when you were 5.

Or the rotary phone your parents still have right now in my case.

Do they still rent it?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#175

Post by eigenrick » Wed, May 14, 2014, 3:12 PM UTC

Everyone in the conversation seems to be pointing out the fact that this is due to integration with legacy software. That's not an acceptable reason.

In the broader sense, there is a great irony in making password "strength" restrictions, like "must include" and "must not include" because they often end up making passwords easier to brute force.

If you start with the restriction that all passwords must have > 8 characters, you have basically an infinite number of possibilities, smart users will use a passPHRASE that is easy to remember. Dumb users will try to hit the bare minimum characters. When you put a restriction of 20 chars, it reduces the possibility that a persons favorite passphrase and guarantees that the set of all passwords is 8-20 characters, which means that the set of all passwords is smaller still.

They disallow special chars, which probably includes space, which further reduces the likelihood that someone will pick a passphrase.

Disallow repeating characters and you've further reduced the entropy.

Disallow Q and Z and it's reduced it further still.

I can't be arsed to do the math, so I'll reference XKCD http://xkcd.com/936/

But Sabre would do well to correct this, the optimal case is simply making a single requirement: passwords must be greater than 8 characters. The don't use your last N passwords requirement isn't bad, but people usually find hacky ways around this.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#176

Post by ryanburk » Wed, May 14, 2014, 3:14 PM UTC

nkurz wrote: post #65

ryanburk wrote: post #61

Earlier quoted context omitted.

it was the simplest way to map 3 letters to each number 1-9 on the keypad.[1] that way you didn't have a few numbers with 4 letters and had a consistent model. [1] my grandfather explained it this way back in the early '80s. I couldn't find a good link to a more official source.

Except that 3 * 9 = 27, and there are only 26 letters in the English alphabet. They are actually mapped to the numbers 2-9, which leaves the question of why they didn't use 1.

ugh, typo. good catch, and good explanation below re: starting a number with an A.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#177

Post by RobotCaleb » Wed, May 14, 2014, 3:18 PM UTC

gcb0 wrote: post #155

dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

so, they have a requirement to maintain compatibility with telephone password input, but require an uppercase character as well? it does not make any sense. this is incompetent developers in a dysfunctional environment. there is no good light anyone can throw at it. and no, having the system live since the 50s is not a good excuse. it is certainly not the same system, for obvious reason.

How far we've come that incompetent only means "enforces strange password rules" while still putting out a large, complex (and functional!) system instead of, well, incompetent.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#178

Post by ryanburk » Wed, May 14, 2014, 3:18 PM UTC

twistedpair wrote: post #162

ryanburk wrote: post #60

Earlier quoted context omitted.

I then wonder if these passwords are even less secure since the backend system would have mapped {A,B,C}=1 at some point for the dialer system to work. so my password "CaB" would be the same as "cab" and "CAB" and "ABC" and "111", etc.

This entropy loss is standard. Try calling the country's leading 401K provider or other banks, they'll ask for your password over the phone keypad. Because of this, most people cannot have punctuation in the password (not on phone keypad), and aB2CaCb becomes 1111111. So much for 104 keys on the keyboard.

the fidelity case scared me years ago. amazed they still do that, but I can also imagine that they have a system that only allows the crazy phone mapping when validating over the phone an policy around that on how many times you can try, phone number you try from, etc to minimize brute force attacks to counter the loss of entropy.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#179

Post by rjacoby5 » Wed, May 14, 2014, 3:42 PM UTC

I think everyone is completely missing the reason behind the omission of Q and Z.

Due to the database storage engine they chose, it was necessary to put a limitation on the number of Scrabble points that a password would award.

Q and Z are both 10-pointers, so passwords with them frequently blew past the limit. You can use J and X, but that's really pushing it.

And the "cannot contain three repeating character" rule is due to that being the trigger for the stored procedure that implements 'triple word score'.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#180

Post by Lagged2Death » Wed, May 14, 2014, 3:45 PM UTC

jedberg wrote: post #112

Lagged2Death wrote: post #74

Earlier quoted context omitted.

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

How do you type your password into your telephone, something this system has to support? That's why you can't use Q and Z -- it's not on the phone.

How do you type your password into your telephone, something this system has to support?

There's a lot of speculation in the thread that this is the reason, and it's not a totally unreasonable guess. If this is the reason, then you're right, my scheme would not be suitable.

While we're all guessing, though, I think there are reasons to doubt a "password via DTMF" requirement. Look at the other rules: Passwords are case sensitive, must contain both letters and numbers, and "Cannot use proper names," whatever that actually means. None of those makes any sense with DTMF, where any string is non-uniquely reduced to a string of digits. Passwords are also limited to 20 characters, which is just as arbitrary with DTMF as with anything else.