UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Steps to reproduce the problem:
1. Start a secret service implementation (e.g., gnome-keyring)
2. Start chromium with the parameter --password-store=gnome-libsecret
3. Save the password for two or more websites (e.g. https://keepass.info/help/kb/testform.htm and https://www.w3schools.com/howto/tryit.asp?filename=tryhow_css_login_form_modal)
4. Start dbus-monitor
5. Go to any website with a login form

What is the expected behavior?
Chromium should only query passwords matching the requested login form (based on url, html fields, etc.). The dbus-monitor log should therefore show at most one call to the method GetSecret.

What went wrong?
Chromium queries the passwords for all items with the attribute "application: chrome-[...]", i.e., it creates (almost) a complete copy of the keyring even though it is not necessary. This violates the idea of having a password manager.

Example for dbus-monitor output (replies removed):

method call time=1530380917.676442 sender=:1.94 -> destination=:1.23 serial=2603 path=/org/freedesktop/secrets/collection/login/520; interface=org.freedesktop.Secret.Item; member=GetSecret
   object path "/org/freedesktop/secrets/session/s2"
[...]
method call time=1530380917.676473 sender=:1.94 -> destination=:1.23 serial=2604 path=/org/freedesktop/secrets/collection/login/519; interface=org.freedesktop.Secret.Item; member=GetSecret
   object path "/org/freedesktop/secrets/session/s2"
[...]
method call time=1530380917.676504 sender=:1.94 -> destination=:1.23 serial=2605 path=/org/freedesktop/secrets/collection/login/517; interface=org.freedesktop.Secret.Item; member=GetSecret
   object path "/org/freedesktop/secrets/session/s2"
[...]
method call time=1530380917.676534 sender=:1.94 -> destination=:1.23 serial=2606 path=/org/freedesktop/secrets/collection/login/516; interface=org.freedesktop.Secret.Item; member=GetSecret
   object path "/org/freedesktop/secrets/session/s2"
[...]
method call time=1530380917.676560 sender=:1.94 -> destination=:1.23 serial=2607 path=/org/freedesktop/secrets/collection/login/511; interface=org.freedesktop.Secret.Item; member=GetSecret
   object path "/org/freedesktop/secrets/session/s2"
[...]
method call time=1530380917.676600 sender=:1.94 -> destination=:1.23 serial=2608 path=/org/freedesktop/secrets/collection/login/124; interface=org.freedesktop.Secret.Item; member=GetSecret
   object path "/org/freedesktop/secrets/session/s2"
[...]
method call time=1530380917.676863 sender=:1.94 -> destination=:1.23 serial=2609 path=/org/freedesktop/secrets/collection/login/3; interface=org.freedesktop.Secret.Item; member=GetSecret
   object path "/org/freedesktop/secrets/session/s2"
[...]

Did this work before? No 

Chrome version: 67.0.3396.87  Channel: stable
OS Version: 4.16.0
Flash Version: 30.0.0.113

Note that this issue also affects the "Manage passwords" dialog in the Chromium settings. Passwords are queried before the user requests the plain text.

To provide some background: I am working on a hardware based password manager and thought that providing a secret service daemon would be a good way to add support for Chromium. If Chromium keeps querying the complete content of the password storage though, then this doesn't make any sense. The passwords are less well protected in a user process compared to the external hardware. Moreover with this excessive query behavior it is not possible to request a hardware based user confirmation before responding to a GetSecret request.