Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

211–220 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#211

Post by dredmorbius »

colanderman wrote: post #195
gcb0 wrote: post #193

Earlier quoted context omitted.

Wait. are you saying that phones that didn't even have the Q and Z inputs are capable of uppercase and lowercase?! all my really old nokias and ericsson and motorolas (that did have Q and Z :) did not made uppercase... pressing one key over and over would cycle the lower case chars only.

We're not talking about text messages; we're talking about DTMF tones. You push the button once, the remote end receives that digit (say, "2"), not a character. Hence, the remote end must assume the "2" to represent either an "A", "B", or "C". What I'm saying is that it's reasonable to further assume that, if the user pressed "2", they may have pressed it to indicate one of the three corresponding lowercase character…

Assuming the system is capable of being accessed both by phone and by a fully-keyboarded device (including, I suppose, a fully-keyboarded phone), then you've got the challenge of authenticating based on either the DTMF tones or the keyboard input. Which means you'd either have to record the hashes both forms (and figure out how to supply the keyboard variant if the initial input is a phone, or allow all compatible keyboard variants), or you're storing the password and comparing the input directly.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#212

Post by imjustsaying »

DonHopkins wrote: post #206
hellerbarde wrote: post #141

Earlier quoted context omitted.

The architecture might have been state of the art and completely reasonable back in "ye olden days". The fact remains that it's not appropriate for 2014. If the reasons for this behemoth are compatibility with 50 years old processes, then these processes have to be modernized so this software can be scrapped. (or fixed, either way a huge project)

If their computer system is from the 1950's and they can't modernize it, why don't they also allow smoking and box cutters on the plane, and dress their stewardesses up all sexy?

You're missing out. Try KoreanAir.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#213

Post by area51org »

_kst_ wrote: post #183
area51org wrote: post #104

Earlier quoted context omitted.

Given the other strange, arbitrary restrictions we've seen in the wild over the years — no "special" characters, no longer than 12 characters, ad nauseum — my bet is that someone has it in his head that restricting the usable character set even further will somehow improve security. How, exactly, a rule like this improves security, I'm sure he cannot say, at least in a sensical way. Most of the time, these weird rule…

How does Perl CGI code make it possible to "shell out" to the OS? I'm sure it can do so if the application isn't coded carefully, but how difficult is it to avoid doing the equivalent of passing user input to eval()?

It's not hard to avoid that, but in the nascent days of the web, few people were thinking that way. We were naive in our code. Sloppy, quickly written Perl was the norm.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#214

Post by gcb0 »

colanderman wrote: post #195
gcb0 wrote: post #193

Earlier quoted context omitted.

Wait. are you saying that phones that didn't even have the Q and Z inputs are capable of uppercase and lowercase?! all my really old nokias and ericsson and motorolas (that did have Q and Z :) did not made uppercase... pressing one key over and over would cycle the lower case chars only.

We're not talking about text messages; we're talking about DTMF tones. You push the button once, the remote end receives that digit (say, "2"), not a character. Hence, the remote end must assume the "2" to represent either an "A", "B", or "C". What I'm saying is that it's reasonable to further assume that, if the user pressed "2", they may have pressed it to indicate one of the three corresponding lowercase character…

but thats my point. if that password rule were to support phones, which i doubt, why the other rule demands a lower case and an upper case char?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#215

Post by gcb0 »

colanderman wrote: post #171
gcb0 wrote: post #155

Earlier quoted context omitted.

so, they have a requirement to maintain compatibility with telephone password input, but require an uppercase character as well? it does not make any sense. this is incompetent developers in a dysfunctional environment. there is no good light anyone can throw at it. and no, having the system live since the 50s is not a good excuse. it is certainly not the same system, for obvious reason.

That makes perfect sense. 'A' and 'a' are both on the 2 key, along with 'b', 'c', 'B', and 'C'.

you make too many assumptions. why not A and a instead of a and A? ...the letter on the key is usually the uppercase.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#216

Post by zhte415 »

xiaq wrote: post #187
zhte415 wrote: post #109

Earlier quoted context omitted.

You've reminded me of something I found interesting regarding passwords in China. Often, faced with minimum password standards, a user will choose the first Romanised (Pinyin - used for keyboard input as well as phoneticisation) letter of a word in a phrase, an example being 我看懂中文你呢？ which is Romanised as 'wo neng kan dong zhong wen ni ne?' or to take the first letter of each word 'wnkdzwnn?' (This phrase, meaning 'I…

You missed a 能 after 我.

Yeah, saw that but couldn't edit any longer. Oh well... IBus was not to blame this time.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#217

Post by rjbwork »

dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

A lot of the comments under this top level one are a bit absurd in decrying that this means they aren't doing anything right and have a bunch of devs in bad environments.

It's as simple as:

1) On password change/account create, run through a small algorithm that turns the password into a series of digits that represent the password as if it were entered on a phone.

2) Hash both password and "digitized" password into 2 separate fields in your store.

3) Now support phone inputs for passwords.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#218

Post by GrinningFool »

grmarcil wrote: post #72
hamiltonkibbe wrote: post #53

Earlier quoted context omitted.

Charles Schwab silently truncates passwords to 8 characters. Always a fun surprise to accidentally enter a password you use somewhere else and get logged in anyways.

I complained to them a while ago about the fact that they limit passwords to 8 characters. Must have been two years ago and I got a very generic "sorry, we know this could be better and our engineers are working on it. In the mean time, we'll send you an RSA security token fob for two factor authentication if you'd like". Thanks but no thanks, I'd rather not add another item to my keychain to make up for your website…

Might not want to add another item to your keychain (or desk drawer), but if you know it's lackluster and you keep your money there, it seems like accepting the token fob would be the smart move .

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#220

Post by Iciloo »

The snow glows white on the mountain tonight, not a footprint to be seen. A kingdom of isolation and it looks like I'm the queen. The wind is howling like this swirling storm inside. Couldn't keep it in, Heaven knows I tried. Don't let them in, don't let them see. Be the good girl you always have to be. Conceal, don't feel, don't let them know. Well, now they know!

Let it go, let it go! Can't hold it back any more. Let it go, let it go! Turn away and slam the door. I don't care what they're going to say. Let the storm rage on. The cold never bothered me anyway.

It's funny how some distance, makes everything seem small. And the fears that once controlled me, can't get to me at all It's time to see what I can do, to test the limits and break through. No right, no wrong, no rules for me. I'm free!

Let it go, let it go. I am one with the wind and sky. Let it go, let it go. You'll never see me cry. Here I'll stand, and here I'll stay. Let the storm rage on.

My power flurries through the air into the ground. My soul is spiraling in frozen fractals all around And one thought crystallizes like an icy blast I'm never going back; the past is in the past!

Let it go, let it go. And I'll rise like the break of dawn. Let it go, let it go That perfect girl is gone Here I stand, in the light of day.

Let the storm rage on! The cold never bothered me anyway...

Post reply on HN