Passwords for JetBlue accounts cannot contain a Q or a Z • Hacker News Board

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#201

Post by dredmorbius » Wed, May 14, 2014, 8:07 PM UTC

colanderman wrote: post #196

pc86 wrote: post #189

Earlier quoted context omitted.

Does this mean that passwords entered on the phone are hashed/encrypted in a case-insensitive manner? I don't understand how this can work unless you're doing the equivalent of .ToLower()/.ToUpper() on everyone on the back end.

Not just case-insensitive, but character-group-agnostic. All the backend knows is that the user pressed "2"; it doesn't know whether that "2" means "A", "B", or "C". (Or, to my point, "a", "b", or "c".) But you're making the mistake of assuming they're hashing passwords at all ;)

But you're making the mistake of assuming they're hashing passwords at all ;)

That, I think, is the correct inference.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#202

Post by dredmorbius » Wed, May 14, 2014, 8:08 PM UTC

RobotCaleb wrote: post #177

gcb0 wrote: post #155

Earlier quoted context omitted.

so, they have a requirement to maintain compatibility with telephone password input, but require an uppercase character as well? it does not make any sense. this is incompetent developers in a dysfunctional environment. there is no good light anyone can throw at it. and no, having the system live since the 50s is not a good excuse. it is certainly not the same system, for obvious reason.

How far we've come that incompetent only means "enforces strange password rules" while still putting out a large, complex (and functional!) system instead of, well, incompetent.

Definitions of competence vary with time and circumstance. The formerly competent may become the currently incompetent, with no change in skillsets or capabilities.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#203

Post by DonHopkins » Wed, May 14, 2014, 8:47 PM UTC

How can people that stupid be allowed to operate airplanes?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#204

Post by DonHopkins » Wed, May 14, 2014, 8:52 PM UTC

umsm wrote: post #197

chinpokomon wrote: post #192

Earlier quoted context omitted.

From that list, the first one mentioned is the worst of the bunch. "8) A password cannot be too similar to a previous password.” How can you possibly know this without storing the password in plain text or without storing something in the database that reveals critical information about the pattern?

You can ask for the old password and the new password twice. Solves your concern without storing anything critical.

Also: "Must not have been used within your last 20 passwords."

So you just have to provide your last 20 passwords.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#205

Post by DonHopkins » Wed, May 14, 2014, 8:58 PM UTC

jedberg wrote: post #112

Lagged2Death wrote: post #74

Earlier quoted context omitted.

This may well be the most elegant way to solve a complex problem. It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low…

How do you type your password into your telephone, something this system has to support? That's why you can't use Q and Z -- it's not on the phone.

Neither are a or b or c or ...

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#206

Post by DonHopkins » Wed, May 14, 2014, 9:01 PM UTC

hellerbarde wrote: post #141

ubernostrum wrote: post #131

Earlier quoted context omitted.

already they're asking me to do the wrong thing Now, yes. The original SABRE dates back to the 1950s, and was not an airline-customer-facing system; SABRE dates to an era when the phone interface was used by airline ticket agents. So if you're going to argue that the design is wrong, you need to argue for why it was wrong for the 1950s use case and interaction patterns, not try to retrofit 2014's use cases and intera…

The architecture might have been state of the art and completely reasonable back in "ye olden days". The fact remains that it's not appropriate for 2014. If the reasons for this behemoth are compatibility with 50 years old processes, then these processes have to be modernized so this software can be scrapped. (or fixed, either way a huge project)

If their computer system is from the 1950's and they can't modernize it, why don't they also allow smoking and box cutters on the plane, and dress their stewardesses up all sexy?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#207

Post by DonHopkins » Wed, May 14, 2014, 9:12 PM UTC

vacri wrote: post #140

stephengillie wrote: post #77

Earlier quoted context omitted.

assword123

Looking through old scripts, you'll sometimes see a matching query for "sername", so you get both Username and username (pseudo case-insensitive) and there's usually a second matching query for... "ssword", because removing "P" gives you "assword", which clearly is improper to put in a script! Harrumph!

Sounds like that script has a back door.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#208

Post by krunk4ever » Wed, May 14, 2014, 9:50 PM UTC

dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

I've encountered telephone login systems which ask me to type in my password in its numeric form (e.g. if my password was 'password', I'd type 72779673)

If JetBlue has a similar logic system via the phone, I can see why Q and Z or prohibited to allow this existing authentication system to work.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#209

Post by chris_wot » Wed, May 14, 2014, 10:28 PM UTC

mikeash wrote: post #169

Justsignedup wrote: post #167

Earlier quoted context omitted.

jaw drop omg crappy sites that don't do more than store a grocery shopping list have better security.

Crappy sites that don't do more than store a grocery shopping list haven't been in continuous operation for five decades.

Given that the web is only really 35 years old, that's a truism.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#210

Post by mikeash » Thu, May 15, 2014, 1:48 AM UTC

chris_wot wrote: post #209

mikeash wrote: post #169

Earlier quoted context omitted.

Crappy sites that don't do more than store a grocery shopping list haven't been in continuous operation for five decades.

Given that the web is only really 35 years old, that's a truism.

Nothing says that legacy systems which are on the internet today can't have started out well before the internet. The legacy system that JetBlue is dealing with in this case has, in fact, been in continuous operation for over five decades.