[Security] u2f : password is filled when session is locked - can be displayed !

[squalou]

I've set-up Fido2 u2f in /etc/pam.d/cosmic-greeter so that I can login and unlock my session with my yubikey.

It works fine.

But since then, if my key is plugged in, and then I lock the session : the password field is pre-filled with my actual password.

As a result it can be displayed !

(unlock fails because a touch of the key is awaited, but anyway, the password is compromised)

Using latest 1.9.0 packages, running PopOS 24.04.

Security "workaround" : manually empty the field when session is locked but ... that's kind of ridiculous, right ;)

[squalou]

Damn, probably a duplicate of #527 ?

But in my case it does never get cleared.

[squalou]

interestingly : if I wait for lockscreen timeout, apparently password field gets cleared.

but then in my case, when u2f key is touched, its value goes in the password field. (so login fails), then second touch works.

probably a matter of focus ? will try.
EDIT : nope. Hit Escape to unfocus password field, then touch the key -> fills in the password field. Second touch works. All in all slower than filling in my password :/