There are many issues I find with the auto-fill function on android. But the biggest of all is that it only works in browsers.
What about apps? If one is security cautious they will prefer using apps over web version of for sensitive services. The only option for apps remains copy & paste of sensitive information which in turn is not cleared from the clipboard and can be read by any other application. Facebook and other apps are well know for checking clipboard for useful information.
And this brings me to the best (in my opinion) method of filling passwords which is Secret Agent on OSX. This method provide max security and smallest attack surface.
Equivalent of Secret Agent on Android will be a custom keyboard. Several other PM have implemented this, here is an example of how it works. Can we get this feature in Codebook, if not any other ideas how to lower the risk of secrets leaking via Android’s clipboard?