The best part of this story is no passwords were compromised. Because Timehop deals with access tokens only, they were able to invalidate those access tokens to eliminate the risk to its users. They basically lost 21m customers by doing that, and props to them for doing the right thing.

Imagine if we still used the "enter your twitter password on our web site so we can look at your data!" anti-pattern. What a mess this would be.

Now if only we could get MFA by default on every service.