Hacker News Reader

> The clear passwords present in jmxremote.password file will now be over-written by their SHA3-512 hash by the JMX agent

I must be misreading this. As far as I can tell the ability to read the new format was added in the same version. Did someone forget about forwards compatibility in the jvm?

View on HN

Also it introduces a race-condition (according to the release notes) where changes made to the file will be lost while it's being converted.

Also they don't say anything about iterating the hash, in which case the password can be recovered anyway with rainbow tables, so what's the point of hashing it?

Reply on news.ycombinator.com