This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login.
These mobile apps call web services to get the functionality done. So they must be using some token based authorization system.
It seems to me that, because the session/token never expires, if someone else gets access to the token/session they would be able to impersonate the user whose token they stole.
My questions are, a) Are above assumptions correct? b) How do mobile phone apps not log you out after some period of time and still achieve good security?