Comment by leni536
5 days ago
App passwords are not scoped, are they? When I set up an app password for my whole google account it is never asked whether it is for email, docs, youtube, etc... . The oauth token is properly scoped.
5 days ago
App passwords are not scoped, are they? When I set up an app password for my whole google account it is never asked whether it is for email, docs, youtube, etc... . The oauth token is properly scoped.
I mean... that's up to Google how they choose to implement app passwords. Back when they still supported them, I think they were properly scoped.
An app password is basically just an API token, it's up to the backend what powers it grants.
API tokens are usually explicitly scoped by the user when they create them. I don't recall Google (or anyone else) ever exposing that when creating an app password, but maybe it was scoped down on first use?