Headline is stated linkbaitly, poorly. tl;dr: Admin reset password to disable user access, was irked that app-specific passwords were not revoked. Did not read

Headline is stated linkbaitly, poorly. tl;dr: Admin reset password to disable user access, was irked that app-specific passwords were not revoked. Did not read docs how to revoke app-specific passwords. Should there be a simpler interface for admins? (Revoke all access YES/NO?) Arguably, yes. Is this a vulnerability? Arguably. My complaint with the headline is that it implies that Google App organizations are at risk RIGHT NOW and that these organizations should be up in arms RIGHT NOW. Instead, there is a mild to moderate risk of continued access to very specific data - which will vary by organization - by terminated employees whose access should be revoked. In the case of email, e.g., they may - and likely do? - already have all their old email on their computer, so the risk increase is mild for this case. Other apps will vary. Better headline: Google Apps user deprovisioning controls inordinately complex, may lead to post-termination security exposure