Android access tokens and access to all Google services

Question

My question is based on the answer on that question: Can the Gmail password be recovered from the Android Gmail app?

So, as I understand when we setup Google account on Android devices, it stores just token for it. But do Google restrict access to own services for that token? As I know after we setted up credentials on device, we can use a lot of Google applications within the same token, like Gmail, Google Plus, Youtube, Google Calendar, Play Store, Chrome, etc. And also chrome also will be authenticated within this token for web surfing.

So, does it mean that if someone steals that token, we can do all these operations manually?

I know, if we use Google OAuth for some permissions, created token will be restricted just to permissions that we asked for. But does Android acquires like mighty token that works for all Google services?

Answer 1

Google uses an OAuth bearer-token to authenticate applications to backed resources. The user still has to type in the username and password to obtain this token.

So can an attacker hijack the token? Yes, if an attacker has rooted a victim's phone they can read any secret on the device. So an attacker can obtain the authentication token from a Google app using a debugger (or other method), and then gain authorized access to a Google service from the phone... So keep your system updated.

Attacks against similar mobile auth tokens can result by accidentally logging the token. This is a pretty common vulnerability, but Google would not make this mistake. (Google has security problems, and the bug bounty program has treated me well.)