Someone shared their google account with me, am I vulnerable?

Question

Recently a friend gave me the credentials to his Google account (GMail and password), so I could check his email while he was on a trip (with no cell signal). He is a trusted friend and not especially tech savvy, so I don't suspect malicious intent. For the record, I thought this was a bad idea, but he insisted.

I was able to log into his GMail account and check his email as well as every other app that used Google for authentication. However, I did not give him my credentials, I only put his account on my device.

At this time I have access to all his information, but I'm worried he has access to mine as well. Is there any way I can check? Is this even possible without him successfully logging in as me once (keep in mind he doesn't have my password).

Answer 1

I would like to point out as far as things you are vulnerable to aside from the mentioned that information from your phone like contacts and photos can be uploaded to his account that he is also most likely able to track your phone if your GPS is on and know your approximate location at any given moment. You may also run the risk depending on your configuration that he can remotely wipe and factory reset your phone. Go to the Android Device Manager Web page to see what I mean. You need to remove his account if you have not already or know that depending on your settings he can track your location and erase your phone.

Answer 2

Google login works in a very not mysterious way. You log into google, and your device remembers it's logged into google. If you have multiple accounts on your device, then you have multiple accounts on your device. This is of course a one way street. So unless they have logged into your account, then no, they have no access to your account.

Of course you can always check, just to be sure.

1. Log into your google account
2. Go into My Account(on google.com, click your avatar, select My Account)
3. Click Security and Logins
4. Scroll down to Devices And Notifications
5. Review Devices. If you see one you don't recognize, deauthorize it.

This way you can be sure only you have access to your account. Of course you friend can do this too, so don't go giving away his info.

Answer 3

If you use an Android phone and you log into your friend's account on it, the OS will sync data with that account.

What will surely work is your friend will be able to install apps on your phone through the Web version of the Play store. The apps cannot activate themselves if installed this way but as soon as you launch them once, they will have access to all the permissions granted to them via the Web interface!

Android also uploads certain sensitive data. For example, automatic backups and Google photos sync, etc. Which account is used for these can be configured, but it is unclear to me how the default is selected. My phone seems to prefer the corporate account for error reporting features, for example.

Answer 4

if you click the wrong popup, he can access all your data.

once you log into a google account, anyone with access to that account can install software on your phone from the play store. that software can access nearly all the information on your phone once you run it. it appears that you would have to launch the app at least once, but that might happen for example if you click a link in an email or on a webpage. also, to get really sensitive info like capturing passwords from your keyboard input, the app would probably need to get you to click a security popup after it launches giving it special system access to your input devices.