I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html
The poster says:
For both of these services, the email address and password for the account are sent to Motorola. Both services support a mechanism (oAuth) explicitly intended to make this unnecessary, but Motorola does not use that more-secure mechanism. The password is only sent over HTTPS, so at least it can't be easily intercepted by most third parties
I would like to know, despite the SSL encrypted connections to Twitter and Facebook, how was Motorola able to collect the email and passwords?
Which leads me onto the question, does the default android email client not protect information, even if it is sent over TLS/SSL on ports 465/993? If some mega company made your phone, and installed their custom rom onto it, would they then be able to circumvent any security mechanism provided by the AOSP base software? If so, what is the solution?