KeePass – weak on Android (and it's Android's fault)

If you're using KeePass on Android, you're most probably syncing your database via Dropbox, Google Drive, any other cloud service, or even some P2P sharing. Whatever you're doing, there is a severe weakness in security that's due to Android. An attacker could just operate as follows: 1. They build an app that has both the "" and the "" permission (most apps have that already) 2. As the external storage is publicly readable, they can just scan it for .kdb and .kdbx files 3. Any such files that have been found can be collected by the malicious app 4. (Optionally, the collected files could be encrypted locally by the malicious app) 5. The files can then be sent to a remote server in the background, without you ever noticing 6. Having a free app with millions of downloads is not that hard (and you could even buy one on eBay) 7. With millions of users, you may collect thousands of KeePass databases (stored on your remote server) that you can try to decrypt patiently