In the introduction part of OAuth 2.0 RFC document, the 4th bullet mentions as follows:
Resource owners cannot revoke access to an individual third party without revoking access to all third parties, and must do so by changing the third party's password.
Cloud someone clarify, what is meant by
third party's password, in the end? I thought it order to revoke access, the resource owner needs to change the password in the server, so that all the 3rd party access would get revoked. Am I missing something?