User scoped external storage can be used to gather credentials of other users