[blakesterz]

> These teenagers are relying on a sophisticated network of trusted Instagram users to post content from multiple different devices, from multiple different locations.

I'm not sure that quite qualifies as a "sophisticated network" but you're right, I would think any service, especially something as big as Instagram, would end all sessions if the password is reset. Could this be by design? Seems like too be to be missed by the security teams though. Does Facebook do the same thing?

[raxxorrax]

From experience I would say that most services do not invalidate access tokes after any account modifications, since you would need to track them. Depending on the service that might not be too trivial, but I would expect services like Instagram to do so. It is becoming more common at least.

[tehlike]

Timestamping the tokens and invrementing timestamp at reset & compare these tses on reset is one way to do it

[lithos]

Was the same for Amazon as well since I was able to change my passwords and Kindle devices still worked. (Might still be the same, but haven't checked recently).

[c0restraint]

I think it's the same on Facebook.

[verelo]

It’s an option, you can choose to log out all devices when you perform a reset.