Why do OAuth tokens invalidate upon password change? I have some apps that need feed posting access for Facebook pages and users are often confused when they stop working after they change their password.
Makes sense as a security feature. Changing your password implies your account's been compromised; killing OAuth authorizations is a way of making sure no one snuck in any authorizations without you noticing in the process.
2-step verification has made that practice obsolete.
I've read that it's better to use 2-step in conjunction with a strong password that you'll remember, versus regularly migrating from one weak or medium strength password to another.
