Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for JetBlue accounts cannot contain a Q or a Z

help.jetblue.com

Post reply on HN
Print view View original

71–80 of 221 posts

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#71

Post by ams6110 »

theboss wrote: post #51
ams6110 wrote: post #47

Earlier quoted context omitted.

Google does the same thing, so I guess Jet Blue is in good company.

I don't know about that. Have a source? This is a pretty bad practice so I would be very surprised to see google doing this.

If you have a google apps account, and you create an account for a user (or adminstratively reset their password for them) they will get an email like:

  Hi Tina,
  
  You have a new account at Example Association.
  
  Your username is tsmith. Your initial password is ZjAdhUVC
  (you will need to change this when you log in).
  
  Your new email address is tsmith@example.com
  
  You can sign in to Example Association services at:
  
  http://www.google.com/a/example.com

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#72

Post by grmarcil »

hamiltonkibbe wrote: post #53
GrinningFool wrote: post #46

That's ok, here's a better one. etrade - yeah, THAT etrade? Yeah. They make your passwords case-insensitive.

Charles Schwab silently truncates passwords to 8 characters. Always a fun surprise to accidentally enter a password you use somewhere else and get logged in anyways.

I complained to them a while ago about the fact that they limit passwords to 8 characters. Must have been two years ago and I got a very generic "sorry, we know this could be better and our engineers are working on it. In the mean time, we'll send you an RSA security token fob for two factor authentication if you'd like". Thanks but no thanks, I'd rather not add another item to my keychain to make up for your website's lackluster password requirements.

I never knew that their website would truncate passwords at 8 characters, but just checked and sure enough it works. This is indicative of the ridiculousness of the 8 char limit, but given the 8 char limit, I don't think it weakens their system at all.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#73

Post by SeanLuke »

honoredb wrote: post #49
GrinningFool wrote: post #46

That's ok, here's a better one. etrade - yeah, THAT etrade? Yeah. They make your passwords case-insensitive.

As does Citibank. I imagine it's for telling-support-over-the-phone purposes, which isn't great.

UNIX historically truncated passwords to eight characters.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#74

Post by Lagged2Death »

eli wrote: post #20

I'd caution against making assumptions about the competence of the developers based only what you can see from the outside. More likely than not there are good reasons to maintain interoperability with legacy systems. This may well be the most elegant way to solve a complex problem. I've certainly written my share of code that would look weird to an outsider who didn't know the backstory and the constraints and the e…

This may well be the most elegant way to solve a complex problem.

It seems to me that these silly, arbitrary restrictions on password lengths and contents are far too common to explain or excuse in this way. The full list of JetBlue's password restrictions looks very much like the restrictions at a zillion other sites. The "no Q or Z" thing is strikingly weird, but its probably less harmful than the (very common) low maximum length restriction, for example.

Maybe I'm out of my depth here, but:

You're generally supposed to run naked user-chosen passwords through some key-stretching hash anyway. That offers the chance to do away with many of these common restrictions from the user's point of view, even if you can't change the capabilities of the old systems underneath. Feed the password through a hash, run the hash result through a filter that expresses the result in the required character set. Now you've got a password the old system can store. The user's chosen password can be arbitrarily long, it can contain any character, and every character of that user-chosen password will effect the "real" password in the old system. Every real password will be the maximum size the old system can store.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#75

Post by squeaky-clean »

theboss wrote: post #51
ams6110 wrote: post #47

Earlier quoted context omitted.

Google does the same thing, so I guess Jet Blue is in good company.

I don't know about that. Have a source? This is a pretty bad practice so I would be very surprised to see google doing this.

I can't reply to the post below you for some reason, so I'm posting here.

Yes, Google sends passwords in plaintext when you have to create an account for another user. But on your first login it requires you to change the password.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#76

Post by stephengillie »

theboss wrote: post #21
iopq wrote: post #17

Earlier quoted context omitted.

oh come on, man everyone's sent those emails before you try to do some smart templating, but your designer changes the template and never actually remembers that those were FILLER VALUES

I actually have no idea what you're talking about. All I know is they sent her plaintext passwords to her, which she redacted before sending to me....

Is that what they did? Cuz that's not what your edited images show.

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#77

Post by stephengillie »

daviding wrote: post #57
skizm wrote: post #56

Actually this kind of gives me an idea: what if modern systems decided to just tell people they can't use "p" so that people stop using the word "password" or variants as their password. Hell, for that matter, tell users they can't use vowels so they can't make words. They might do leet speak, or whatever which is pretty easy to crack given time, but it stops things like password re-use attacks (people less likely to…

psswrd123

assword123

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#78

Post by rosser »

ryanburk wrote: post #60
seanmccann wrote: post #9

They use Sabre (like others), and it's an archaic holdover from when phones didn't have Qs or Zs.

I then wonder if these passwords are even less secure since the backend system would have mapped {A,B,C}=1 at some point for the dialer system to work. so my password "CaB" would be the same as "cab" and "CAB" and "ABC" and "111", etc.

since the backend system would have mapped {A,B,C}=1

Not necessarily. For all we know, Sabre could have scooped T9, and transmitted a "C" by sending three single pulses, or an "N" with two groups of six. (We're talking about the days of rotary phones, not touch-tone, remember.)

Re: Passwords for JetBlue accounts cannot contain a Q or a Z

#80

Post by manojit »

Why people are still restricting password complexity. As long as passwords are carefully & cryptographically processed (read hashed with individual salt). I recently designed a system where the only password policy is the length (8 char minimum) and they are stored hashed with salt being a specially encoded user id (thus unique for each user).

I also like to contradict myself. Password complexity and and all the policy are needed to make the social engineering not feasible. I mean a strong and secure system and with that people are using 'password1234' is a very bad practice.

Post reply on HN