App exposes password -- significant security problem

[CarlosNZ]

Seems like this app is not being updated any more, so might be pointless to post, but there is a big problem where my user account password is being pasted into text fields.

Seems to be a timing issue, but occasionaly when the Mac is unlocked my account password is pasted/typed into whatever text input was last in focus. I just see my password sitting there exposed, only one false click away from sending it out to who-knows-where.

Obviously this makes the app pretty much unusable in its current state, so would be great if there was a fix available. Works great other than that :)

I'm on latest Tahoe, FWIW

[yuhuai1413]

我尝试来修复一下这个问题

[JulieZqq33]

请问有进度嘛大佬

[XueshiQiao]

It's a scary problem.

[bananamacaca]

I checked the current source, and this does look like a real race condition.
BLEUnlock checks isScreenLocked() only once, then reads the password from Keychain and sends it using system-wide CGEvent keyboard events. It does not check again whether the screen is still locked or whether the login password field has focus.
If the Mac is unlocked by Apple Watch, Touch ID, or another method during that short window, the queued keystrokes may be delivered to whichever text field gets focus after unlocking. The code also sends Return after the password, which could make this even more serious.
Relevant code:
tryUnlockScreen(): https://github.com/ts1/BLEUnlock/blob/master/BLEUnlock/AppDelegate.swift#L280-L306
fakeKeyStrokes(): https://github.com/ts1/BLEUnlock/blob/master/BLEUnlock/AppDelegate.swift#L247-L268
So the reported behavior is consistent with the current implementation, especially if macOS Tahoe changed the timing around unlocking and restoring application focus.