Does changing my password after OAuth login in mobile app help reduce risk?

Question

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and password on their server, then passing it to Google OAuth.

Does changing your password immediately after OAuth login help reduce risk somewhat? If I understand correctly, the third party would still have their token for limited API access, but at least not the master password to my Google account (even if they are storing it improperly).

On a related note: On Android, I didn't have to login again for OAuth for a third party app, I could just select the Google account that was already registered on the phone. But on iOS, the third party apps I used required a Google OAuth login via webview. Is it possible for iOS apps to have the "integrated" OAuth without login?

Answer 1

No. When an application uses and of Google's identity APIs (to include OAuth and Google+ Sign in) the application receives a token from Google indicating that you are you. Then the application signs you in.

One of the major benefits of offloading the password management to Google is that the application doesn't have to store your password (notice that at no point in the above diagram does the application receive your password).

If you decide to not allow an application access to your profile you can simply revoke access, and the token is invalidated.

Generally with all of the ID management methods the application can get mostly basic information about you. Here is a source about what the application may request for Google+ sign in.

Answer 2

No, you can not do that legally. If you want to be sure, you can use a packet analyzer like Wireshark. Or you can also use Anti-virus/Privacy tool or Phishing detectors. You can check the code of application. At last, you can also switch off your internet to see the error message and confirm which link could not be loaded(or if it loads without error, that can be a problem. Maybe cache, so try again after resetting data)

That's all I know for now. Maybe there's more, like specialized apps to check your packets are going to the right place, or something else. New things always keep coming.