Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

21–30 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#21

Post by theboss »

iopq wrote: post #17
theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

oh come on, man everyone's sent those emails before you try to do some smart templating, but your designer changes the template and never actually remembers that those were FILLER VALUES

I actually have no idea what you're talking about.

All I know is they sent her plaintext passwords to her, which she redacted before sending to me....

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#22

Post by mikeash »

eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

In this case, a legacy system (Sabre) whose origins predate the integrated circuit.

I'm sure a lot has changed since then, but it's a bit scary to wonder what hasn't.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#23

Post by fiatmoney »

mikeash wrote: post #16
lvs wrote: post #10

Looks like it has to do with the venerable Sabre system (scroll to bottom): http://kottke.org/12/06/the-worlds-worst-password-requiremen...

It's worth noting that when you say "venerable" you mean it. Basic research for what would become Sabre first started in 1953, development started in earnest in 1957, and it was online in 1960. It's also interesting that the project got its start because an IBM salesman just happened to be sitting next to the president of American Airlines on a flight, and that salesman happened to be working on a massive air defense…

Less of a coincidence when flying was expensive enough to be reserved for the "jet set".

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#24

Post by elsporko »

amichal wrote: post #5

guessing... Touch tone phone keypads dont always show q and z. I suspect that some older JetBlue system allows you to use your password via a touch tone system (with a vastly reduced keyspace)

That would also explain the last rule:

Cannot contain special characters or symbols (such as !#$@*, etc).

It seems to be geared toward those with cell phones but not necessarily 'smart' phones (with full keyboards).

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#26

Post by eli »

mikeash wrote: post #22
eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

In this case, a legacy system (Sabre) whose origins predate the integrated circuit. I'm sure a lot has changed since then, but it's a bit scary to wonder what hasn't .

I don't find that scary. I think it's a testament to the original architects and to the people who maintain it.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#28

Post by SnakeDoc »

eli wrote: post #26
mikeash wrote: post #22

Earlier quoted context omitted.

In this case, a legacy system (Sabre) whose origins predate the integrated circuit. I'm sure a lot has changed since then, but it's a bit scary to wonder what hasn't .

I don't find that scary. I think it's a testament to the original architects and to the people who maintain it.

It's engineering thoughts like this that continue the proliferation of terrible, and insecure login systems.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#29

Post by rallison »

theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

While I can't stand passwords sent as part of a welcome email, this does not actually mean that they store the passwords in plaintext. Often, companies will send the username and password as part of a welcome email upon the user registering (and the above screenshots look exactly like that). This does not preclude the company from then hashing the password and storing it hashed.

That said, it still is a terrible practice, as any records of that email on the origin server or servers in between will thus contain the plaintext password.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#30

Post by mikeash »

fiatmoney wrote: post #23
mikeash wrote: post #16

Earlier quoted context omitted.

It's worth noting that when you say "venerable" you mean it. Basic research for what would become Sabre first started in 1953, development started in earnest in 1957, and it was online in 1960. It's also interesting that the project got its start because an IBM salesman just happened to be sitting next to the president of American Airlines on a flight, and that salesman happened to be working on a massive air defense…

Less of a coincidence when flying was expensive enough to be reserved for the "jet set".

No doubt. Interestingly, this meeting didn't happen on a jet and probably predates the term "jet set", as the first jet airliner had only entered service the year before. The IBM salesman thinks it might have been a DC-6:

http://conservancy.umn.edu/bitstream/11299/107637/1/oh034rbs...

Interesting little note from that:

"I learned later that he would be sitting in his office in New York and he'd suddenly wonder how things were getting along in L.A. He would tell his secretary, "I'm going to L.A." He would go to the airport, just walk on a plane, and fly out without a shaving kit, pajamas or anything. Then he would take a look around and catch another plane back."

I doubt many company presidents are taking that sort of approach anymore.

Post reply on HN