Google Authenticator used by native apps?

Question

I recently turned on two-step verification for my Google account and installed the Google Authenticator app on my Android device. Based on what I have read everywhere (even Google's official info: http://support.google.com/mail/bin/answer.py?hl=en&answer=1173270), I was under the expectation that I would have to generate an application specific password for some of the apps on my Android device - gmail, youtube, etc. However, that hasn't happened. Everything continues to work fine on my device including gmail, youtube, sync functionality, etc. I have restarted the device, forced it to sync manually, etc...no problems, and I'm never prompted to enter a verification code, never set the device as trusted, etc.

How does this work? Are the Google Android native apps using the Google Authenticator service behind the scenes to generate codes?

Answer 1

Native Google apps don't use password (which you entered before activating 2-step authentication) everytime to log in. They only need it for the first time. After the first authentication, an Auth. Token is downloaded which is used for subsequent logins. As this Auth. Token isn't your main password, verification code isn't required at all. So, your apps continue to work without asking anything.

To invalidate this Auth. Token, you'll have to change your main password. Do it and you'll be asked to enter password in Android device. And, this time, your main password wouldn't work. You'll have to generate and use application-specific password. Native Google apps don't prompt for verification code. They only seek passwords which would let them authenticate.