I use LastPass for Android with the PIN option. After having entered my full Lastpass password the first time that I used the app, now when opening the application I have access to all my passwords just by entering a four-digit PIN.
How secure can this be? Where might the data stored such that it is accessible by PIN only? Is it likely that the passwords are stored on the Android file system unencrypted? Perhaps the passwords are stored on the Android file system encrypted with the PIN as a key?
I am concerned that if the user could access the data with a four-digit PIN, then so could an attacker. I am concerned about an online or otherwise electronic attacker, not physical access to the device. Note that the device (Samsung Note 3) is not yet rooted, but it likely will have a custom ROM installed on it sometime in the future.