Sean Peever

So I'm actually amazed at the level of fail on the IT side here, and as such I wanted to share with everyone what I found with the recent password changes that were forced. As end users I feel it's only fair that people are made aware.

1) AC let me use the same old password that they forced me to change - this completely eliminates the effect of forcing me to change my password.

2) When logged in now after I changed to a new password, AC let's me use BOTH my OLD and NEW password to login. Yes, that's right! My old password and my new password both work when logging into my account with AC now.

• This is amazing because the old one they forced me to change still works
• This is amazing because I can log into my account using 2 different passwords
• This is amazing because I might have changed my password for a reason (maybe it's been compromised) and this means me, as the user, even if I know my password is compromised, I cannot stop it from working.

I'm going to go cry in a corner on behalf of all IT security professionals now.

Bohemian1

I can't repro - Is this on the app or the website?

Sean Peever

website and app both accept old and new password for me.

canadiancow

Is this Mobile+ or your Aeroplan number login?

Mobile+ is not accepting my old password, and I wasn't forced to change my Aeroplan password.

Sean Peever

Zeeflys

Jumper Jack

It might take some time to refresh .. though for sth like password, you would think that's not the case.

Sean Peever

lincolnjkc

How long was your old password?

I have no experience with AC systems but I've seen some services that will allow you to enter a password of any length but will only use the first X (where X is commonly 8, 10, 12, or 16) characters for validation.

Some will also drop/ignore non-alphanuneric characters but thats less common in my experience.

KenHamer

So.... Wednesday, Then?

jc94

songsc

It is likely that AC uses a hash algorithm that only hashes the first 8 or so digits of the password, this is very likely as the new password is just one extra character comparing to the old one. Try change that special character to something else, or add more characters. If the problem still exists, this is likely the cause.

On the other hand, if this is an example of birthday attack, whatever AC person looking at this better change the hash algorithm and/or salt ASAP.

expert7700

If so everyone at AC needs to be fired in such a spectacular way that the entire internet makes a laughing stock of them.

The more I think of this, the more I can see the situation happening.

Take for example Aeroplan. I think can only take 10 characters and no special characters. Now as bad as they are at least they tell the end user this. If there is a regulatory requirement or scope of work policy for strong passwords then they blatantly (but publically) fail.

Flip side, imagine programmers of an ancient/relic IT system (ahem--AC) want to disguise the real database problem or limitation without properly fixing things to bring it to Y2K standards.... Just ACCEPT as strong of a password the user inputs. Heck, even REQUIRE a strong password and pat yourself on the back. Ask your boss for raise since you enabled strong passwords in record time and within budget. Or so it seemed. What you really may have done was have the input script blow any hint of security by stripping out all the extra characters before it is saved or authenticated as a password to the database. (Why stop there? Why not convert input to all lowercase, strip out half the characters, remove any numbers, or just save the vowels.)

Maybe OP should be scolded for trying to hack the system by doing something as appalling as using a '$' in his password. The nerve of some people.

//time to rethink computer passwords. There are 3 possible responses. Valid password, invalid password, or "meh, close enough"

canadiancow

The password is required to be 10+ and required to have special characters, so if they were doing that, it would affect literally everyone.

vernonc

Meh, close enough. LOL