diff --git a/greeter/authenticator.cpp b/greeter/authenticator.cpp
--- a/greeter/authenticator.cpp
+++ b/greeter/authenticator.cpp
@@ -247,10 +247,16 @@
         {
             if (!GRecvArr( &arr ))
                 break;
-            QByteArray utf8pass = m_password.toUtf8();
-            GSendStr(utf8pass.constData());
-            if (utf8pass.constData() != nullptr)
+
+            if (m_password.isNull()) {
+                GSendStr(nullptr);
+            } else {
+                QByteArray utf8pass = m_password.toUtf8();
+                GSendStr(utf8pass.constData());
                 GSendInt(IsPassword);
+            }
+
+            m_password.clear();
 
             if (arr)
                 ::free( arr );
@@ -278,8 +284,6 @@
             cantCheck();
             return;
         case ConvPutAuthAbort:
-            // what to do here?
-            return;
         case ConvPutReadyForAuthentication:
             m_ready = true;
             if (m_mode == AuthenticationMode::Direct) {
diff --git a/kcheckpass/checkpass_pam.c b/kcheckpass/checkpass_pam.c
--- a/kcheckpass/checkpass_pam.c
+++ b/kcheckpass/checkpass_pam.c
@@ -121,7 +121,7 @@
 
 #ifdef PAM_FAIL_DELAY
 static void
-fail_delay(int retval ATTR_UNUSED, unsigned usec_delay ATTR_UNUSED, 
+fail_delay(int retval ATTR_UNUSED, unsigned usec_delay ATTR_UNUSED,
 	   void *appdata_ptr ATTR_UNUSED)
 {}
 #endif
@@ -168,7 +168,8 @@
   pam_error = pam_authenticate(pamh, 0);
   if (pam_error != PAM_SUCCESS) {
     if (PAM_data.abort) {
-      pam_end(pamh, PAM_SUCCESS);
+      PAM_data.abort = 0;
+      pam_end(pamh, pam_error);
       return AuthAbort;
     }
     pam_end(pamh, pam_error);