Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

191–200 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#191

Post by mendelk »

mindcrime wrote: post #164
mikeash wrote: post #16

Earlier quoted context omitted.

It's worth noting that when you say "venerable" you mean it. Basic research for what would become Sabre first started in 1953, development started in earnest in 1957, and it was online in 1960. It's also interesting that the project got its start because an IBM salesman just happened to be sitting next to the president of American Airlines on a flight, and that salesman happened to be working on a massive air defense…

Goes to show the power of knowing the right people, or in this case, coincidentally meeting them on a plane. It's funny how air travel, in some regards, actually turns out to be somewhat egalitarian, especially on Southwest where you have no "First class cabin". You can go for "Business Select" but that just means you get in line earlier to get on the plane, but it doesn't put you in any special area. Amusing anecdot…

This is the premise of "Delta Innovation Class"[0].

[0] http://www.deltainnovationclass.com/

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#192

Post by chinpokomon »

lvs wrote: post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

From that list, the first one mentioned is the worst of the bunch. "8) A password cannot be too similar to a previous password.”

How can you possibly know this without storing the password in plain text or without storing something in the database that reveals critical information about the pattern?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#193

Post by gcb0 »

colanderman wrote: post #171
gcb0 wrote: post #155

Earlier quoted context omitted.

so, they have a requirement to maintain compatibility with telephone password input, but require an uppercase character as well? it does not make any sense. this is incompetent developers in a dysfunctional environment. there is no good light anyone can throw at it. and no, having the system live since the 50s is not a good excuse. it is certainly not the same system, for obvious reason.

That makes perfect sense. 'A' and 'a' are both on the 2 key, along with 'b', 'c', 'B', and 'C'.

Wait. are you saying that phones that didn't even have the Q and Z inputs are capable of uppercase and lowercase?!

all my really old nokias and ericsson and motorolas (that did have Q and Z :) did not made uppercase... pressing one key over and over would cycle the lower case chars only.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#194

Post by brokentone »

RobotCaleb wrote: post #177
gcb0 wrote: post #155

Earlier quoted context omitted.

so, they have a requirement to maintain compatibility with telephone password input, but require an uppercase character as well? it does not make any sense. this is incompetent developers in a dysfunctional environment. there is no good light anyone can throw at it. and no, having the system live since the 50s is not a good excuse. it is certainly not the same system, for obvious reason.

How far we've come that incompetent only means "enforces strange password rules" while still putting out a large, complex (and functional!) system instead of, well, incompetent.

Password rules is one place that is relatively visible that shows business rules and tech limitations in play.

If the system shows a misunderstanding of security or makes it clear that shortcuts were taken, then what is to make you think the same didn't occur on a deeper and more important level (databases, security, etc).

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#195

Post by colanderman »

gcb0 wrote: post #193
colanderman wrote: post #171

Earlier quoted context omitted.

That makes perfect sense. 'A' and 'a' are both on the 2 key, along with 'b', 'c', 'B', and 'C'.

Wait. are you saying that phones that didn't even have the Q and Z inputs are capable of uppercase and lowercase?! all my really old nokias and ericsson and motorolas (that did have Q and Z :) did not made uppercase... pressing one key over and over would cycle the lower case chars only.

We're not talking about text messages; we're talking about DTMF tones. You push the button once, the remote end receives that digit (say, "2"), not a character.

Hence, the remote end must assume the "2" to represent either an "A", "B", or "C". What I'm saying is that it's reasonable to further assume that, if the user pressed "2", they may have pressed it to indicate one of the three corresponding lowercase characters. Humans generally ignore case.

What's not reasonable is to assume that a human, faced with a DTMF pad without a Q or a Z, would press anything. Sure, you could interpret all digits as a possible "Q" or "Z", but it's equally likely that a human in such a situation would leave the character out, or give up and call tech support. It's simpler to just disallow these characters.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#196

Post by colanderman »

pc86 wrote: post #189
colanderman wrote: post #171

Earlier quoted context omitted.

That makes perfect sense. 'A' and 'a' are both on the 2 key, along with 'b', 'c', 'B', and 'C'.

Does this mean that passwords entered on the phone are hashed/encrypted in a case-insensitive manner? I don't understand how this can work unless you're doing the equivalent of .ToLower()/.ToUpper() on everyone on the back end.

Not just case-insensitive, but character-group-agnostic. All the backend knows is that the user pressed "2"; it doesn't know whether that "2" means "A", "B", or "C". (Or, to my point, "a", "b", or "c".)

But you're making the mistake of assuming they're hashing passwords at all ;)

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#197

Post by umsm »

chinpokomon wrote: post #192
lvs wrote: post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

From that list, the first one mentioned is the worst of the bunch. "8) A password cannot be too similar to a previous password.” How can you possibly know this without storing the password in plain text or without storing something in the database that reveals critical information about the pattern?

You can ask for the old password and the new password twice. Solves your concern without storing anything critical.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#198

Post by mikeash »

jonknee wrote: post #185
mikeash wrote: post #168

Earlier quoted context omitted.

Sure, but how often do they just decide, on a lark, to go check out how operations are going at one of their sites on the other side of the country?

It depends on the executive, but I would say it's not uncommon. Perhaps not on a lark, but because something pops up at the last minute. This portion of Walter Isaacson's Steve Jobs biography comes to mind: > Early in his tenure, Cook was told of a problem with one of Apple's Chinese suppliers. "This is really bad", he said. "Someone should really be in China driving this." 30 minutes later he looked at an operations…

That's not even remotely similar.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#199

Post by dredmorbius »

breadbox wrote: post #190
dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

And as others have noted, this doesn't make sense given that passwords are case-sensitive and are required to include uppercase characters. If there's a mechanism for specifying case on the phone, there can be a mechanism for specifying Q and Z unambiguously. I certainly have used VM systems that explicitly told me to "use 7 to represent Q and 9 to represent Z." A contractual requirement is one possibility that could…

Case-sensitivity is an interesting observation. It makes it 1) more likely that the passwords are being stored and that 2) there are multiple interfaces used: the Web front-end which can handle capitalization (something which can be unambiguously transformed) and a back-end SABRE system which likely cannot but a case-shifted password could still be passed to it.

As for your voicemail system, that merely gets around the issue of competing standards by enforcing its own. And the mapping has to be repeated to every user for every use of the system. I'd actually consider it an argument in favor of the keypad theory.

Escape codes (or testing codes) is another possible explanation. And legacy code cost is indeed often a consideration.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#200

Post by dredmorbius »

eli wrote: post #160
dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

You don't see how it might have been a problem for the original system to allow you to set a password on one phone that (appears to be) impossible to enter on a different phone?

That's specifically the problem that the Q/Z restriction works around.
Post reply on HN