Actually Android phones cannot use two way authentication so after you enable it in google account you will have to create an application specific password: tha

Actually Android phones cannot use two way authentication so after you enable it in google account you will have to create an application specific password: that means that your android phone will login to google account using your usual username and a "per application" password randomly generated by google. That is the one that is stored in the sql db. All google has to do is to make sure that you cannot login using that same password from two concurrent sessions. So if your phone is stolen: you revoke the android-specific password; if your db is phished or acquired, google will revoke the android-specific password once the attackers tries to use it.