My question is based on the answer on that question: Can the Gmail password be recovered from the Android Gmail app?
So, as I understand when we setup Google account on Android devices, it stores just token for it. But do Google restrict access to own services for that token? As I know after we setted up credentials on device, we can use a lot of Google applications within the same token, like Gmail, Google Plus, Youtube, Google Calendar, Play Store, Chrome, etc. And also chrome also will be authenticated within this token for web surfing.
So, does it mean that if someone steals that token, we can do all these operations manually?
I know, if we use Google OAuth for some permissions, created token will be restricted just to permissions that we asked for. But does Android acquires like mighty token that works for all Google services?