My MP is more than 40 chars long, but it's not really a chore to type it in considering we are texting much longer strings than that literally all the time.

Many of them support biometric authentication using Android's API.

Also, to enter the master password, all of them use whatever keyboard is installed, some of them send a message to them to work in "incognito mode" for what good that it. That said, for Keepass2Android and KeePassDX, they offer their own keyboard to enter secure credentials on sites you log into once your password manager is unlocked. That allows you to circumvent the system clipboard entirely, which is a major attack surface. Some apps also support the android autofill feature.

> [...] considering we are texting much longer strings than that literally all the time.

Without typos? Typing a tweet or text message into your phone, your thumbs hit somewhere near the right characters and your phone figures out what words you meant as you type. The uncorrected characters are often gibberish. This is a very different use case from having to get the case and special characters right for a 40 character password.

Without typos. I use a keyboard that has no predictive features, swiping, or suggestions. But I understand your point. Personally I found training myself to type accurately worth it but most people may not.

What's wrong with typing in 20 characters on a phone keyboard? My password is longer than that and I don't have an issue

Alternatively you can use fingerprint unlock

Because it takes a long time. On the rare occasion I log into something on my phone, it takes almost a minute to type in the random passwords that Keepassxc on my computer generates.

Fingerprint authentication will work though.

Once you're logged in, just copy/paste the password? You only need to type out your master password manually.

Am I misunderstanding the issue?

On Android you should not copy/paste as all apps can read the clipboard. Use either a keyboard that comes with the password manager, or system auto-fill support that gets the values from the manager. Both modes are supported at least by Keepass2Android.

I use diceware to make a master password that's reasonable to type on a device.

Bitwarden is able to produce diceware style passwords too.

https://theworld.com/~reinhold/diceware.html

1Password allows you to use your fingerprint on Android and I'd assume TouchID or FaceID on iOS as well.

Yes, it does, TouchID works fine on my iPad and macOS devices :)

The other question would be, how do you handle this without a password manager?

And is this a known problem of Android, that there are keyboards that can log your keys?

Personally, I don't trust Android and all the crap installed in it at all. So, I do very limited secure activities on my phone. I have never logged into my email on my phone, for instance [1]. The only thing private is messenger apps, which is an unfortunate minimum requirement on social life. Always looking for a way out.

[1] Also because I deal with work on my own time.

I use Simple Keyboard (based on the AOSP keyboard), which is a very basic FOSS keyboard with no logging, suggestions or any of that. Other good options with more features most people want are OpenBoard and AnySoft. Hacker's Keyboard is a decent one too.

Related question: Does anyone have any suggestions for an OSS keyboard with suggestions and (good) swipe functionality? I currently use Gboard and it's great, but, well, it's a Google product.

The FOSS keyboard with the best swipe functionality is AnySoft. But it is miles behind SwiftKey and Gboard in my experience. With some patience and training it is serviceable though.

This is why I stick with SwiftKey. Nothing beats it, and although it got bought by Microsoft, they did not Frankenstein it. If you look for the app start with the 'M' of Microsoft though.

Yeah, I think SwiftKey with a firewall blocking outgoing requests is the most feature-rich keyboard experience on Android which isn't outrageously privacy invasive

Personally, I still like using Simple Keyboard. It's the complete opposite of something like Swiftkey. does one thing and does it well, is super light too.

You can use a fingerprint to authenticate on Android.

The problem is, most if not all Android devices do not provide some secure-enclave like architecture where the crypto key to unlock is secured by hardware design, but rather simple software solutions where the master unlock key resides in memory. So if you happen to have any malware combined with a security exploit, they might access your vault without requiring a fingerprint.

I do not trust any android device with my vault for exactly that reason.

>The problem is, most if not all Android devices do not provide some secure-enclave like architecture where the crypto key to unlock is secured by hardware design, but rather simple software solutions where the master unlock key resides in memory

Why is this relevant? Even if you do have secure enclave, if you can do arbitrary memory reads a malicious app can simply wait until your database is unlocked and dump your database when it's unencrypted in memory. Moreover, if you have some sort of exploit that gives you operating system level access, you can simply impersonate the password manager app (eg. changing uids, or patching the executable in-memory) and get the secure enclave to do the decryption.

"wait" means run in the background. Once more this is not possible on iOS.

This is incorrect. There are multiple ways of running tasks in the background eg. https://www.raywenderlich.com/5817-background-modes-tutorial.... Moreover, if you have sandbox escape (probably a prerequisite for getting arbitrary memory reads) you don't have to wait because you can use the other methods I've mentioned in the second half of my prior comment.

This is just completely incorrect. https://developer.android.com/training/articles/keystore

It says that secure enclave is optional. Do you know of any vendor that ship hardware based secure enclave? AFAIK there are no major vendors that actually do this, so this is just operating system level protection, not hardware based.

Keepass2Android can install it's own keyboard.