Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

161–170 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#161

Post by acdha »

gcb0 wrote: post #155
dredmorbius wrote: post #111

As several people have noted, the Q/Z restriction likely arises from inputting passwords from a telephone keypad. What I haven't seen is a statement as to why this would have been a problem. The reason is that Q and Z were mapped inconsistently across various phone keypads. The present convention of PQRS on 7 and WXYZ on 9 wasn't settled on until fairly late in the game, and as noted, the airline reservation system,…

so, they have a requirement to maintain compatibility with telephone password input, but require an uppercase character as well? it does not make any sense. this is incompetent developers in a dysfunctional environment. there is no good light anyone can throw at it. and no, having the system live since the 50s is not a good excuse. it is certainly not the same system, for obvious reason.

Consider how important air travel is and the wide range of situations people use to book or change travel plans. It's completely unsurprising that someone would be reluctant to say that no device or system in use anywhere in the world would have a problem with this.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#162

Post by twistedpair »

ryanburk wrote: post #60
seanmccann wrote: post #9

They use Sabre (like others), and it's an archaic holdover from when phones didn't have Qs or Zs.

I then wonder if these passwords are even less secure since the backend system would have mapped {A,B,C}=1 at some point for the dialer system to work. so my password "CaB" would be the same as "cab" and "CAB" and "ABC" and "111", etc.

This entropy loss is standard. Try calling the country's leading 401K provider or other banks, they'll ask for your password over the phone keypad.

Because of this, most people cannot have punctuation in the password (not on phone keypad), and aB2CaCb becomes 1111111. So much for 104 keys on the keyboard.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#163

Post by gpcz »

roel_v wrote: post #145
hellerbarde wrote: post #141

Earlier quoted context omitted.

The architecture might have been state of the art and completely reasonable back in "ye olden days". The fact remains that it's not appropriate for 2014. If the reasons for this behemoth are compatibility with 50 years old processes, then these processes have to be modernized so this software can be scrapped. (or fixed, either way a huge project)

" then these processes have to be modernized" How so? So people can use Q's and Z's in their passwords? What would your business case look like? "Hey everybody let's spend $500 million so people can use arbitrary passwords, because [entropy], never mind most people use the name of their cat anyway?"

As ridiculous as that pitch might sound, it makes the implied security-money tradeoff directly visible to management and causes them to make a formal decision.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#164

Post by mindcrime »

mikeash wrote: post #16
lvs wrote: post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

It's worth noting that when you say "venerable" you mean it. Basic research for what would become Sabre first started in 1953, development started in earnest in 1957, and it was online in 1960. It's also interesting that the project got its start because an IBM salesman just happened to be sitting next to the president of American Airlines on a flight, and that salesman happened to be working on a massive air defense…

Goes to show the power of knowing the right people, or in this case, coincidentally meeting them on a plane.

It's funny how air travel, in some regards, actually turns out to be somewhat egalitarian, especially on Southwest where you have no "First class cabin". You can go for "Business Select" but that just means you get in line earlier to get on the plane, but it doesn't put you in any special area.

Amusing anecdote... I was flying back to NC from San Francisco last week and started talking to the guy sitting next to me. He mentioned being in the beer industry, so I asked who he worked for, and he said "Miller-Coors". Later I happened to ask him what his role there was, and he replied "CEO".

Turns out he's from North Carolina and we had a nice talk on the way in. And as it was, I wasn't trying to sell him anything (we mostly talked about beer), but it's funny that I got to sit and chat for an extended period of time with a big-shot CEO that I never could have gotten a meeting with otherwise.

So yeah, air travel can definitely result in some interesting chance encounters.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#165

Post by gabriel34 »

couchand wrote: post #100
Istof wrote: post #96

Earlier quoted context omitted.

If you use the "forget password" link and receive your old password by email, then they more then likely have your plain-text password unless they crack it on the fly?

If you receive your old password then yes, they do have it stored in plaintext. Usually these days forgotten password pages just ask you to create a new one, but if they don't that's a sure sign.

Not so sure; it could still be encrypted (also bad practice)

Still, if you receive your password back, that is a giant red sign screaming insecurity

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#166

Post by Nicholas_C »

lvs wrote: post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

Sabre Red and JetBlue's customer loyalty program (of which these requirement are for) probably have nothing to do with each other. I'm trying to think of how they could be related in a way that would affect what passwords could be used but I can't.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#167

Post by Justsignedup »

lvs wrote: post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

jaw drop omg crappy sites that don't do more than store a grocery shopping list have better security.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#168

Post by mikeash »

jonknee wrote: post #83
mikeash wrote: post #30

Earlier quoted context omitted.

No doubt. Interestingly, this meeting didn't happen on a jet and probably predates the term "jet set", as the first jet airliner had only entered service the year before. The IBM salesman thinks it might have been a DC-6: http://conservancy.umn.edu/bitstream/11299/107637/1/oh034rbs... Interesting little note from that: "I learned later that he would be sitting in his office in New York and he'd suddenly wonder how th…

> I doubt many company presidents are taking that sort of approach anymore. That's why they buy a jet with company money now.

Sure, but how often do they just decide, on a lark, to go check out how operations are going at one of their sites on the other side of the country?

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#169

Post by mikeash »

Justsignedup wrote: post #167
lvs wrote: post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

jaw drop omg crappy sites that don't do more than store a grocery shopping list have better security.

Crappy sites that don't do more than store a grocery shopping list haven't been in continuous operation for five decades.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#170

Post by jtheory »

lectrick wrote: post #105
eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

No. If there is a bizarre password restriction like this, it is almost certainly because they are storing the password in cleartext somewhere (bad) or because they expect users to be able to enter the password in via a telephone keypad, which vastly reduces the number of possible combinations since every number substitutes for 3-4 letters (also bad).

> or because they expect users to be able to enter the password in via a telephone keypad, which vastly reduces the number of possible combinations since every number substitutes for 3-4 letters (also bad).

Not so much as you may assume. I'd bet (not with much money, admittedly) that you can't get into the web interface with a telephone-digit variant of your password.

I'm not sure where in their architecture phone-keypad-compatibility lies, but it's quite possibly not even in any user-facing system.

In that case, the security of your password is not much reduced -- only if someone has access to that telephone-access system, and can do something bad with it.

Post reply on HN