Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

51–60 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#51

Post by theboss »

ams6110 wrote: post #47
theboss wrote: post #13

That's nothing.... A friend of mine forwarded some emails shes gotten from jet blue. First this screenshot: http://i.imgur.com/oKKpFM1.png Followed by the money screenshot: http://i.imgur.com/DlAlQPt.png She redacted some of the information before she sent it (obviously). This is from Jan 21 of this year. It's just so sad.... It's incredible people still have plaintext passwords serverside....

Google does the same thing, so I guess Jet Blue is in good company.

I don't know about that. Have a source? This is a pretty bad practice so I would be very surprised to see google doing this.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#52

Post by 8_hours_ago »

stephengillie wrote: post #48

When I saw the Sabre password requirements, I couldn't help but imagine that passwords are stored entirely numerically - "badpass" would be entered (hashed?) as "2237277", as in dialing a phone. So the password "abesass" would collide with "badpass" and grant access. Has Sabre at least upgraded their storage mechanism, or do (did?) they reduce entropy on passwords?

I was also curious about this and decided to test it. I created a new account with the password "badpassbadpass" (minimum password length of 8!), but I was unable to log in with "abesassabesass". There was also no error when I tried to put a 'q' and a 'z' in my password, so I'm guessing that they've updated their system since the documentation was written.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#53

Post by hamiltonkibbe »

GrinningFool wrote: post #46

That's ok, here's a better one. etrade - yeah, THAT etrade? Yeah. They make your passwords case-insensitive.

Charles Schwab silently truncates passwords to 8 characters. Always a fun surprise to accidentally enter a password you use somewhere else and get logged in anyways.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#54

Post by jfoster »

If they were OK with applying more duct tape, why not map Q and Z to characters (eg. A and B) that can be part of passwords? (eg. a password of "quiz" would become "auib")

It would make their password system slightly weaker perhaps, since freq(a) then becomes more like freq(a)+freq(q) and freq(b) more like freq(b)+freq(z). I'm not sure that's much weaker than just excluding Q and Z, though. The user experience is improved. The major downside would be in technical debt.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#55

Post by elwell »

jfoster wrote: post #54

If they were OK with applying more duct tape, why not map Q and Z to characters (eg. A and B) that can be part of passwords? (eg. a password of "quiz" would become "auib") It would make their password system slightly weaker perhaps, since freq(a) then becomes more like freq(a)+freq(q) and freq(b) more like freq(b)+freq(z). I'm not sure that's much weaker than just excluding Q and Z, though. The user experience is imp…

Or you map them to something like:

Q = ABDHCJSKJDHSSS

Z = YYYDUHUHUHSSYS

... to avoid weakening the password.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#56

Post by skizm »

Actually this kind of gives me an idea: what if modern systems decided to just tell people they can't use "p" so that people stop using the word "password" or variants as their password.

Hell, for that matter, tell users they can't use vowels so they can't make words. They might do leet speak, or whatever which is pretty easy to crack given time, but it stops things like password re-use attacks (people less likely to have the same password as their other apps) and simple guessing attacks (try top 3 most popular passwords on all known emails/accounts).

For such a simple rule set (no vowels) it forces a decent level of password complexity.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#57

Post by daviding »

skizm wrote: post #56

Actually this kind of gives me an idea: what if modern systems decided to just tell people they can't use "p" so that people stop using the word "password" or variants as their password. Hell, for that matter, tell users they can't use vowels so they can't make words. They might do leet speak, or whatever which is pretty easy to crack given time, but it stops things like password re-use attacks (people less likely to…

psswrd123

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#58

Post by barsonme »

skizm wrote: post #56

Actually this kind of gives me an idea: what if modern systems decided to just tell people they can't use "p" so that people stop using the word "password" or variants as their password. Hell, for that matter, tell users they can't use vowels so they can't make words. They might do leet speak, or whatever which is pretty easy to crack given time, but it stops things like password re-use attacks (people less likely to…

One issue for IT is having employees write down their passwords. I can imagine something like this would have the same effect and probably decrease security somewhat. Although, take what I say with a grain of salt. I'm not sure how prevalent having your passwords physically stolen outside of a closed environment like a workplace is.

There are a lot more variables at a job than at my house in my locked drawer.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#60

Post by ryanburk »

seanmccann wrote: post #9

They use Sabre (like others), and it's an archaic holdover from when phones didn't have Qs or Zs.

I then wonder if these passwords are even less secure since the backend system would have mapped {A,B,C}=1 at some point for the dialer system to work. so my password "CaB" would be the same as "cab" and "CAB" and "ABC" and "111", etc.
Post reply on HN