Comments on: Java – Console

By: SCJP 1.6 and SCJP 1.5 « Welcome to Kosovar Java Community

SCJP 1.6 and SCJP 1.5 « Welcome to Kosovar Java Community — Fri, 25 Feb 2011 12:40:07 +0000

[...] depth: exception handling, collections, assertions, threads, and flow control. See this topic, java.io.Console, java.util.NavigableSet and SCJP 6 vs SCJP 5 for more [...]

By: Paul

Paul — Sat, 01 May 2010 02:30:06 +0000

Thanks for the info. Yet another scenario where heap is readable is JVM crash with core dump.Core dump will have whatever was in heap at the time.

By: Samuel

Samuel — Mon, 19 Apr 2010 17:07:36 +0000

Thanks,
Always useful info

By: shruti

shruti — Sun, 21 Feb 2010 19:41:17 +0000

thanks CertPal
post is very useful
good discussion
thanks for the efforts

By: Fort

Fort — Tue, 22 Dec 2009 13:24:56 +0000

Just in time before I take my certification exam. Good article/tutorial. Thanks!

By: CertPal

CertPal — Wed, 11 Nov 2009 05:29:49 +0000

@Luciano I am glad you found it useful. Thank you for leaving your thoughts here

By: Luciano

Luciano — Wed, 11 Nov 2009 01:44:37 +0000

Very Useful!

I didn’t found any other reference instead of the Java API.

Congrat’s

By: CertPal

CertPal — Fri, 30 Oct 2009 07:53:28 +0000

@Yousuff Thanks Yousuff. @Sonika I am glad you found it useful. Thank you for leaving a comment

By: Sonika

Sonika — Fri, 30 Oct 2009 06:32:48 +0000

Good post.
This article helped me a lot to understand the facts of Console class and that too very easily.
Thanks a lot!!!

By: Yousuff

Yousuff — Sun, 06 Sep 2009 12:01:01 +0000

It very good article which never came across before. Good job…

Your blog is informative and good to spend

By: CertPal

CertPal — Mon, 24 Aug 2009 15:56:53 +0000

@James @Monu ah ! a good point. You should still be able to sniff the heap data. I have to agree that getting rid of the reference as soon as possible is a good idea.

By: James

James — Mon, 24 Aug 2009 15:37:28 +0000

You are right. Strings are immutable and they remain in the heap until the garbage collector takes over. And when they are in the heap, they can be read by some profiling tools and heap analyzers.

However this is a great post. Thanks for putting this up.

By: Monu

Monu — Thu, 20 Aug 2009 12:12:16 +0000

You are right, the string returned by readLine() might not go to the constant string pool. However, it remains in heap.

There is a little security note in the description of the Console class that reads:

If an application needs to read a password or other secure data, it should use readPassword() or readPassword(String, Object…) and manually zero the returned character array after processing to minimize the lifetime of sensitive data in memory.

What I said was based on the above statement-perhaps too much thinking and assumptions.

By: CertPal

CertPal — Thu, 20 Aug 2009 04:16:39 +0000

@Monu
You are welcome.

I am not sure if readLine() sends Strings to a pool, and even if it did, it is not necessarily any safer. I am not aware of a scenario where an outsider would be allowed to read java’s internal String pool.

Thanks for sharing your thoughts

By: Monu

Monu — Thu, 20 Aug 2009 04:05:32 +0000

Hi,

First of all, thanks for this post.

BTW, you can also mention the fact that since readPassword returns a char array and not a string(like readLine) the password will not be pooled and hence it is considered a safer method than readLine().