A ratchet, a device lock and session revocation are three different things; no new message replaces cutting off a thief’s access.
If your unlocked phone is stolen, the safe assumption is that accessible information on it may be viewed or copied. Sending a message from another device does not, by itself, guarantee that the thief’s session is invalidated or their access to future messages is cut off.
Device locking, account-session management and recovery of cryptographic security are three different tasks. In a real incident, all three need attention; no ratchet replaces locking or revoking access from the missing device.
What should you do first?
Act from a trusted device and do not confront the thief to retrieve your phone. If there is immediate danger, your own safety comes first.
- Use the manufacturer’s official tool to locate and lock the device. On Android, Find Hub provides locking and erasing tools; execution of commands depends on the device’s state and connection.
- Review sessions and devices connected to important accounts and revoke the stolen device’s access through the official route, if the service offers this option.
- Also check your email account and recovery methods. An attacker may use that same phone to recover other accounts.
- If your SIM card is at risk, contact your carrier to block it or transfer the line securely. This does not replace revoking app sessions.
- Notify sensitive contacts through a trusted channel that they should verify unexpected messages from your account for now.
Remote erasure can be irreversible and may change your ability to track the device. Before choosing it, consider official guidance and any need to preserve evidence. Do not equate a recorded or sent command with confirmed execution on the device.
Exactly what can the thief access?
| Level of access | Possible risk | Relevant action |
|---|---|---|
| Unlocked phone and accessible app | Reading or sending messages from the account | Lock the device and limit account access |
| Valid app session | Continued activity until expiration or revocation | Revoke the session through the service’s official route |
| Copied key or cryptographic state | Risk to some communications, depending on the data type | Review cryptographic identity and sessions and verify contacts again |
| Malware or persistent access | Ongoing collection of fresh data | Restore device and account security; changing a password alone is not enough |
Phone theft does not necessarily mean all keys are immediately extracted; however, the absence of evidence of extraction is not a reason to consider an unlocked phone harmless.
What does post-compromise security mean?
Post-compromise security, or PCS, aims to restore protection for future messages after some cryptographic state has been exposed, when the necessary conditions are met—for example, fresh data that the attacker does not have is introduced and their access does not continue.
The Double Ratchet specification distinguishes recovery against an eavesdropper from the danger of a device or keys remaining under an attacker’s control. This property neither removes malware nor invalidates a session token, and it cannot take back messages already read.
Changing the key with each message is not enough on its own, either. If an attacker has the state needed to calculate the next key or still has access to the phone, the “next message” is not necessarily the point of recovery.
What should be checked about Livara?
Livara’s threat model offers no guarantee against access to an unlocked or infected phone. The security documentation also distinguishes identity recovery from chat history. This article provides no evidence for the claim that “logging in on a new phone automatically disables the old session.”
If you use Livara, check the actual session and recovery controls in your installed version and confirm the result of access revocation. Do not assume that changing a password or recovering a key deletes all previous sessions. After a cryptographic identity change, sensitive contacts should verify the new key through an independent route.
What should you prepare before an incident?
A strong lock and suitable automatic locking, system updates, hidden sensitive previews and secure access to recovery methods are useful. Android theft-protection tools vary by device and version; check their availability on your own phone.
Have a short plan: which alternative device will you sign in from, how will you close sessions, and where will you find your recovery key without relying on the missing phone?
Key principle: Restoring security is a process. Do not consider it finished after sending one message, changing one key or seeing one warning.
