I've asked this question before, but got no suitable replies, so here I go again. How does the Android AccountManager which is used to store your Google, Facebook, Twitter, etc... usernames and passwords implement security. For instance, off my phone is rooted, can't a third party app read the account passwords of wherever it stood them. I figure that the account manager must store these passwords somewhere on the device our logging in would not work, especially if the device was offline. Thank you for your explanations.
We cannot look into the sources of the Google AccountManager: while Android itself is open source, the Google apps are not. But we can make an educated guess:
It's not necessary to store passwords on the device in this case. You once enter your password, it gets confirmed server-side, and you receive an "authentication token" in return. That token is saved on the device, and used by it until it gets invalid (either by expiring or by being revoked) – in which case you will be asked again for your password, and the game starts over. This is why you can simply "revoke access" from devices without having to change your account password.
The token is always specific to the device (same reason – otherwise you couldn't revoke access from one device without affecting any other). I can't say whether the token would be useless to some "root app" aquiring it without your permission (non-root apps would have to ask you for your confirmation when first accessing it), or what they could do with such a token while offline (again, closed-source parts) – maybe someone else is able to shed a light on that.