News for hackers. Stuff that matters.

A comment on JDK 10 Early Access Release Notes.

Re:JDK 10 Early Access Release Notes by malft on Saturday February 24, 2018 @02:34PM (#16454853)
> The clear passwords present in jmxremote.password file will now be over-written by their SHA3-512 hash by the JMX agent

I must be misreading this. As far as I can tell the ability to read the new format was added in the same version. Did someone forget about forwards compatibility in the jvm?

[ Parent | on HN ]
Re:JDK 10 Early Access Release Notes by ptx on Saturday February 24, 2018 @03:48PM (#16455318)
Also it introduces a race-condition (according to the release notes) where changes made to the file will be lost while it's being converted.

Also they don't say anything about iterating the hash, in which case the password can be recovered anyway with rainbow tables, so what's the point of hashing it?

[ Parent | on HN ]