Android security

[2dm]

Hi all!

I'm a new android user, so you may find this next question quite foolish, but still important to me:
When I allow an app to access my account, lets say for example to sync my gmail tasks/calendar/contacts and etc. , does this app or its developer can get my account password? Or get all information from my account?
Is there a way to ensure this permission doesn't "passed on" from my device?

Thanks!

 

[alostpacket]

Hi 2dm! Welcome to the forums!

Have a look here: http://androidforums.com/android-ap...ps-avoid-viruses-guide-those-new-android.html

Short answer is no, the app wont get access to your password, unless you type it in yourself. The app gets permission to access your account with what's called an "auth token" which does not include your password.

 

[jerofld]

Also, as a secondary measure, Google has a 2 step security measure.

2-step verification - Google Apps Help

 

[2dm]

Thanks!!!
That's a great guide you wrote there!

One thing I didn't fully understand about the 'use credential' permission - does an app that get AuthToken has limitations about what to use from the account? like just calendar or just pictures.
It sounds like it isn't...

 

[alostpacket]

As far as I can tell it gives the app a wide rage of control, obviously the app cant change your password, and certain services like gmail, require additional permissions - but generally speaking you should only give out "account" related permissions with great caution.

 

[2dm]

I was afraid it's not as good as I hoped it to be...
Thank you again!