App security

Long story, but with the bottom line that my bag was stolen containing a tablet. The givenergy app was installed on this tablet.

Tablet was/is secured with a pin, but clearly a worry.

So my question.... How do I ensure that someone could not access the app?

If I go to my copy on the phone and change the password it does not appear to have any effect. The app on my wife's phone still works. So it is reasonable to think that the copy on my missing tablet would still work!

So where is the security?

4tea2 Lots of IT systems issue a signed token when the user successfully authenticates and this will be presented every time you make an API call. This will usually contain some basic information about the user/principal and their roles or authorised claims - as well as an expiration date which should never be longer than thirty days.
You can think of the token like the credentials ambassadors of old would present to other leaders - a wax sealed letter from the Monarch presenting their ambassador and stating that this person speaks for them. The wax seal is replaced by a digital signature, each intended to convey the authenticity of the data.
The alternative would be for the app to retain your password in a retrievable form and present that with each API call which would be terrible for security.
If you tried to login using your old password on a new device then that should not work. So that just leaves the question of the device already authenticated.
If we assume that the GivEnergy app does indeed use a token system then your questions are 1) how long until the token expires and 2) will the token refresh work on your tablet and wife's phone now that you have changed your password. Only GivEnergy can answer that question.
If you haven't already done so you could migrate your account to SSO which might have the effect of throwing existing devices off. It will also likely have higher security more aligned with modern best practices.
The other thing to look into is if you can send a remote wipe command to the device using your Apple/Google account.

Thank you @pwdst a very interesting reply, well explained. One follow on question.... In this context, what do you mean by switching to SSO?

And yes I have requested a remote wipe, but this does depend on the tablet being switched on and in range of some WiFi. Hopefully they just factory reset the tablet.

And as a warning to anyone reading this post... Beware electric closures on hatchback doors. The taxi driver loaded bags into the SUV, pressed the door close as we all got in the car, he moved to get in and while that was happening two lads walk by, stuck an arm in and nicked my bag. Electric closures stop if they hit your arm! By the way all happened in the very busy pickup point by St Pancras Stn

@pwdst Don't worry about clarifying your reference to SSO. I've found the givenergy info. It must have passed me by!

Anyone have experience of migrating to SSO?

I did, it was relatively painless. This is the best resource I could find to send you.

https://givenergy.co.uk/givenergy-transition-to-new-sso-service-in-further-commitment-to-data-security/

Thanks. Interesting info, but confusing because of the emphasis on installers.

I'll see if I can make enough sense to give it a go.

Givenergy.cloud allows you to setup a second account as well as change the password on your existing account. It should also have 2 factor authentication (all new givenergy cloud accounts need this). We found out that using both the cloud and app at the same time with the same account caused whichever device signed in first to show blank info (but no error message) so it is worthwhile having a second account. This is for the All In One.

if you go into the cloud then account settings, click the manage account security button and you can setup a second account, change passwords, revoke any API tokens etc