Tell me more ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.
up vote 8 down vote favorite
1

I was rather shocked today to discover that my android phone was still syncing email after I had revoked it's app specific password on gmail.

Can anyone else confirm that this happens on their devices too?

Found another users post about it here but there is no reply from google.

Feeling very uneasy about the security of my stuff now :/

UPDATE:

Yeah, I was doing it wrong. But I think Google could document the process a little better.

share|improve this question
Does revoking Android login from here affect it? accounts.google.com/IssuedAuthSubTokens – Bryan Denny♦ Jun 26 '12 at 14:05

1 Answer

up vote 9 down vote accepted

What's going on is that your phone is not using your password. When you log in an Oath token is issued. This is more secure, because your password is not stored on the device. It also has the additional benefit that it can automatically log you in in your browser. To deny access to your phone, remove the authentication token here.

Moreover starting with ICS you don't need to use applications specific passwords for your phone. Enter your regular Google account info; it will notice that you have 2-factor authentication enabled and open an internal browser where you can log in using your OTP.

share|improve this answer
Ok that worked, thank you. But now I'm a little confused - So are you saying that even on Gingerbread this was the way to revoke access? If so, what was the 'revoke app specific password' button for? Did Google publicise this change between ICS and prior versions? I hadn't read anything (obviously ;) – UpTheCreek Jun 26 '12 at 17:35
I'm not sure about GB as I only tried this on ICS and I don't have another device at hand. If it was publicized, it didn't reach me (nor the 10+ Android blogs that I'm reading) I only found out about this by accident. As for the revoke password: The app engine SDK, the music manager Google Talk client, email clients and many other stuff still needs a password so it still has a use case. – Richard Borcsik Jun 26 '12 at 17:48
Ok thank you. I'll update that google forum thread with this info too (I wasn't the only one confused!) – UpTheCreek Jun 26 '12 at 18:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.