Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device.
In the native applications for Windows, OSX, and Linux, whenever the database is locked or exited, the password is erased from memory by filling its location with zeroes.
Since Java itself does garbage collection in a different manner, is there a real, tangible concern over storing passphrases in memory in the JVM? How about in Dalvik for Android?
Other than setting
this.password = null;, what can be done to ensure that the passphrase has been securely erased from memory?