Hacker News Reader

The easy and widespread solution to this issue is simply to ask the user if they would like to log out their other devices when they change their password.

I agree - but it should be an option, rather than permanent.

LTT found out the hard way, their attacker had a session token for an employee and changing everyone’s passwords didn’t lock the attacker out.

So that's how they address the state issue. They just ignore the problem!

I always wondered how they addressed the state problem of cookie bearer tokens.