3

Recently a friend gave me the credentials to his Google account (GMail and password), so I could check his email while he was on a trip (with no cell signal). He is a trusted friend and not especially tech savvy, so I don't suspect malicious intent. For the record, I thought this was a bad idea, but he insisted.

I was able to log into his GMail account and check his email as well as every other app that used Google for authentication. However, I did not give him my credentials, I only put his account on my device.

At this time I have access to all his information, but I'm worried he has access to mine as well. Is there any way I can check? Is this even possible without him successfully logging in as me once (keep in mind he doesn't have my password).

  • There is actually a feature in gmail which allows you to share your email with another gmail account. In the future I'd recommend this method, as it does not require your friend create an account on your device. – CLW Oct 14 '15 at 20:56
3

I would like to point out as far as things you are vulnerable to aside from the mentioned that information from your phone like contacts and photos can be uploaded to his account that he is also most likely able to track your phone if your GPS is on and know your approximate location at any given moment. You may also run the risk depending on your configuration that he can remotely wipe and factory reset your phone. Go to the Android Device Manager Web page to see what I mean. You need to remove his account if you have not already or know that depending on your settings he can track your location and erase your phone.

  • Wow, I didn't even think of that. Is there a way to disable remote wipe on the phone? I'm not overly concerned with him seeing my location, contacts or photos since he's a friend. I don't think he would wipe the phone, but accidents happen. – Aabglov Oct 14 '15 at 20:22
  • 1
    Find Google Settings in one of these places (depending on your device): A separate app called Google Settings In your main Settings app, scroll down and touch Google Touch Security. Under "Android Device Manager," switch Remotely locate this device and Allow remote lock and factory reset on or off. support.google.com/accounts/answer/3265955?hl=en – David- Oct 14 '15 at 20:26
  • Hope that helps ya. You may also want to go into his account under settings and disable any sync's options you would dislike such as contacts or what ever else you don't want him to have if your are staying signed in. – David- Oct 14 '15 at 20:33
  • Yes, this is exactly the kind of weird gotcha I was looking for. I had a bad feeling there must be a downside to this. Thank you so much for the heads up. – Aabglov Oct 14 '15 at 20:35
  • No problem. It never hurts to be informed, and you were right to question what it entails to log someones account into your phone. – David- Oct 14 '15 at 20:38
8

Google login works in a very not mysterious way. You log into google, and your device remembers it's logged into google. If you have multiple accounts on your device, then you have multiple accounts on your device. This is of course a one way street. So unless they have logged into your account, then no, they have no access to your account.

Of course you can always check, just to be sure.

  1. Log into your google account
  2. Go into My Account(on google.com, click your avatar, select My Account)
  3. Click Security and Logins
  4. Scroll down to Devices And Notifications
  5. Review Devices. If you see one you don't recognize, deauthorize it.

This way you can be sure only you have access to your account. Of course you friend can do this too, so don't go giving away his info.

1

If you use an Android phone and you log into your friend's account on it, the OS will sync data with that account.

What will surely work is your friend will be able to install apps on your phone through the Web version of the Play store. The apps cannot activate themselves if installed this way but as soon as you launch them once, they will have access to all the permissions granted to them via the Web interface!

Android also uploads certain sensitive data. For example, automatic backups and Google photos sync, etc. Which account is used for these can be configured, but it is unclear to me how the default is selected. My phone seems to prefer the corporate account for error reporting features, for example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.