Yes, that's one thing (I can update the settings plugin part and make sure both changes land at the same time).

Would still not take care of the fact that one could do `dbus-monitor --system` and see the result of `getGeneratedPassword()` as well as the parameter to `setPassword()` (of course, the malicious app must be running during the time when the user sets a new password or retrieves it). If we can disable these calls and from being monitored, that'd fix the problem.