Lost or stolen phone

Your phone holds the owner key: the only key that can change your device list. If you lose it, cut it off at each computer. This needs someone at the computer: by design, nothing on a server can do it for you.

What a finder can do

Situation	What they can do
Phone locked	Nothing, as planned: the app will create its `device` key so that it does not sign while the phone is locked (the app is coming in M1)
Phone unlocked, without your fingerprint or PIN	Actions that need no fingerprint: see status, tasks and rules, put a computer to sleep, add a rule that only notifies, cancel a rule or a shutdown, rename a device
Phone unlocked, and they know your PIN	Everything you can do from the phone, until you forget the phone on each computer

What a finder cannot do, even with your PIN:

Add their own phone. A computer refuses a device list from the phone that adds a phone, changes any device’s kind or keys, or gives a computer keys. New phones join only through connecting, with a click at the computer.
Turn remote control back on. Only the computer itself can.

Cut the phone off

On each computer:

Turn remote control off (the Tealhand app: Settings, This computer; on a headless computer, stop the Host and run tealhand-host remote off). The phone can then only read status and cancel.
Disconnect the phone. In the Tealhand app: Devices, under “Devices that manage ⟨this computer⟩”, Disconnect beside the phone, confirmed with Windows Hello. On a headless computer:
Terminal window
```
# stop tealhand-host run first (Ctrl-C), then:
tealhand-host unpair
```
It prints “Forgot the phone. This computer accepts no commands until you connect one again with tealhand-host connect.”
Connect your new phone (Connect your phone), then start tealhand-host run again.

Forgetting wipes the device list, every rule and any running notice, and drops open connections. The computer’s own key stays, so connecting again is quick. The journal keeps a line saying the phone was forgotten. The old phone then sees that computer as forgotten (“This computer forgot this phone and no longer accepts its commands. Connect again to use it.”), not as offline.

Each computer keeps its own copy of the device list, so disconnecting the phone on one computer changes nothing on the others: the phone keeps its access there until you disconnect it on each of them. The computer you disconnected keeps no device list, so it can no longer reach your other computers from its Tealhand app either, until it is connected to a phone again.

A lost or stolen computer

A computer on your device list can control your other computers without a fingerprint (Control your other computers from a computer). If one is lost or stolen, open Devices on your phone and remove it. The phone sends the new list to your other computers, and each one refuses that computer from then on. Until then, each computer’s own Remote control and SSH access switches limit what it can do.

If you run your own relay

Your new phone has a new owner key. On the relay:

Add the new phone’s key to allowed_owners.
Remove the old phone’s key. When the relay starts, it ignores stored device lists of owners that are no longer allowed, so the old phone and its devices are no longer let through.
Restart the relay.

See Run your own relay.

Why it works this way

Only the owner phone can sign a new device list, so a computer cannot remove the phone by editing the list itself. Instead it throws its saved connection away and accepts nothing but a new one. The risk that stays: until someone at the computer acts, the finder can read status and use the actions that need no fingerprint.