CWE-212: Improper Removal of Sensitive Information about yubioath-flutter

[dainnilsson]

Thank you. We consider this to be out of scope of the threat model of this application. A user with administrator/root access to the system will be able to capture user-provided credentials in a number of different ways, such as by keylogger or screen capture.

Our website's claim which you mention is using the word "credential" to refer to the cryptographic keys used to generate the OTPs for logging into accounts, not the user-provided "credentials" that are the subject of this issue. The "cannot be extracted" part is in reference to the YubiKey's secure element. During provisioning of credentials for the YubiKey these values may exist outside of the secure element in application memory.