#884550 regression(?) in greeter-hide-users=true behavior

Package:
lightdm-gtk-greeter
Source:
lightdm-gtk-greeter
Description:
simple display manager (GTK+ greeter)
Submitter:
Benjamin Kaduk
Date:
2017-12-17 19:09:04 UTC
Severity:
normal
#884550#5
Date:
2017-12-16 15:40:17 UTC
From:
To:
After my latest upgrade/reboot, the behavior of lightdm has changed.
Previously, on fresh boot and lock screen I would be
presented with a username/password entry dialog with empty username,
empty password, and focus on username.  The new behavior has
username pre-populated and focus on password.  (Is this more likely
to be lightdm-gtk-greeter or lightdm itself?)

My understanding is that greeter-hide-users=true is intended to not
give any indication of the valid users on the machine, whether
currently/previously logged in or not.  (If I am in error here,
please accept my apologies and close the report.)  I think I am
using an unmodified stock debian config,

root@prolepsis:~# lightdm --show-config
   [Seat:*]
   A  greeter-session=lightdm-greeter
   A  greeter-hide-users=true
   A  session-wrapper=/etc/X11/Xsession

   Sources:
   A  /usr/share/lightdm/lightdm.conf.d/01_debian.conf
   B  /etc/lightdm/lightdm.conf


My latest upgrade went from 2.0.2-1 to 2.0.3-1, but the previous
upgrade cycle did not involve a reboot, if that would have been
necessary to get the 2.0.2-1 version running.

Thanks,

Ben

#884550#10
Date:
2017-12-17 15:28:36 UTC
From:
To:
username when the screen is locked with the current logged-in user (not sure
of the behavior when multiple users are locked).

Not sure about upstream stance on this, but I configured the Debian default to
be a bit privacy-conscious and not expose every username just by booting the
system. I'm not overly concerned with the lock screen (afair xscreensaver did
the same thing before we switched to light-locker), but if it's a concern to
you I can propagate this to upstream.

Regards,

#884550#15
Date:
2017-12-17 19:02:59 UTC
From:
To:
Doing this for locked screen seems pretty defensible; I don't log
out or boot up cleanly enough to notice the behavior for
non-lock-screen cases.

I think my main concern is just knowing with some confidence that I
should retrain my muscle memory/expectations; I don't think there's
a need to forward the issue to upstream just on my behalf.

Thanks for the explanation,

Ben