macOS High Sierra 10.13 briefly flashes screen content last seen before locking the screen when awaken On macOS High Sierra 10.13.2, when I manually lock the screen (shift+ctrl+power) and later press any key to turn it on, the screen content which was shown at the time I locked the screen is briefly displayed on the screen (something like 1/30 or 1/60 of a second — I can measure it with high speed camera but it doesn't matter much) before it finally displays the login UI.

I've never seen it before High Sierra, but now I can reproduce this 100% of the time. This is really annoying because this might allow a stranger to capture screen contents which were shown immediately before the screen was locked.

I found one workaround which is far from perfect: lock the screen, wake up and press 'esc' to turn off the screen again. Then at the next wake up, nothing is revealed.

Are there any better workarounds? Is it worth reporting to Apple as a security/privacy bug?

Update:
If I use cmd+ctrl+Q to lock the session as suggested in comments, it makes the bug less frequent, but doesn't really solve it. In other words it turns a suicide self shot into a Russian Roulette.

Update 2:
macOS 10.13.3 is affected as well.

Update 3:
still not fixed in macOS 10.13.4.

Update 4:
still not fixed in macOS 10.13.4 with Security Update 2018-001.

Update 5:
still not fixed in macOS 10.13.5.

Update 6:
I am not 100% sure but I think I saw it again in macOS 10.13.6 too.
Yes - the frame buffer should be scrubbed / discarded as part of the sleep / lock process no matter how brief the render. I don't think it's a huge risk and can be mitigated as you say by logging out of the screen before locking or any number of other ways like timed lockouts.

I'd just log out or enable fast user switching and switch away from the screen instead of letting the screen saver lock.

Apple publishes a page with instructions on how to report issues. If this were a huge gap, I'd consider asking you to delete the thread, but I don't think this is "stop the planet" serious unless there's a way to abuse this "feature".

https://support.apple.com/en-us/HT201220


  Security and privacy researchers
  
  To report security or privacy issues that affect Apple products or web
  servers, please contact product-security@apple.com.