IssueTracker

https://android.googlesource.com/platform/frameworks/base/+/HEAD/core/java/com/android/internal/widget/LockPatternUtils.java

Strings are immutable, and connot be wiped or zeroized. Using Strings violates best practices for handling of secrets ("Using Password-Based Encryption," http://docs.oracle.com/javase/1.4.2/docs/guide/security/jce/JCERefGuide.html). Additionally, I've been on the conference calls where the Pen Testers have found the artifacts in memory.

771.    public byte[] passwordToHash(String password) {
772.        if (password == null) {
773.            return null;
774.        }
775.        String algo = null;
776.        byte[] hashed = null;
777.        try {
778.            byte[] saltedPassword = (password + getSalt()).getBytes();
779.            byte[] sha1 = MessageDigest.getInstance(algo = "SHA-1").digest(saltedPassword);
780.            byte[] md5 = MessageDigest.getInstance(algo = "MD5").digest(saltedPassword);
781.            hashed = (toHex(sha1) + toHex(md5)).getBytes();
782.        } catch (NoSuchAlgorithmException e) {
783.            Log.w(TAG, "Failed to encode string because of missing algorithm: " + algo);
784.        }
785.        return hashed;
786.    }