Signet
dev.digitalgrease.signet
android AGPL-3.0-only kind 32267
Verify calls from family, colleagues, sources against deepfake impersonation.
latest release
0.4.0
main
released 2026-10-25 00:19 UTC
download apk
signet-v0.4.0.apk · 64.4 MB
✓ signed
cert e63e48ac…
about
- description
- When someone who sounds like your mother calls in a panic asking for bail money, Signet lets you verify it's actually her. Each paired contact generates a rotating 4-word phrase that only the real person's phone can produce. You ask her to read her phrase aloud; you type what you hear. Green banner: verified. Red banner: something's wrong — hang up and call her back on a number you already trust. Signet works over any channel. Voice calls, video calls, text, email, in person. The only requirement is that the two of you paired once, in person or over a trusted channel, before the crisis. Built for a world where AI voice cloning is commodity. Defends against: * Real-time voice and video deepfakes * Pre-recorded deepfake voicemails * Vishing using scraped biographical knowledge * Compromised messaging accounts where the attacker has chat history but not the paired device * SIM swaps * Reflection attacks: the rotating code is direction-aware, so an attacker echoing your own phrase back at you fails Core properties: * No server. No cloud. No account. No INTERNET permission. * No telemetry. No analytics. No ads. * Hardware-backed secrets via Android Keystore, StrongBox when available. * Offline-first; airplane mode does not affect any flow. * RFC-validated crypto (X25519, HKDF-SHA-256, AES-256-GCM, BIP-39). * Open source, AGPL-3.0. v0.3 includes in-person pairing, long-distance pairing, lost-phone recovery via paper or file, multi-relationship storage, in-person rekey, bulk backup (every paired relationship in one encrypted file with a single 8-word unlock), a printable challenge-response grid for when the other side can't reach their phone, liveness prompts for video calls, and screenshot blocking on sensitive screens. Not included: duress codes (gated on an abuse-analysis pass), account recovery (there is no account), cloud backup (out of scope forever).
- publisher
- 78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d
- first seen
- 2026-10-08T05:08:38.060750+00:00
- last event
- 2026-10-25 00:19 UTC
- website
- https://github.com/digital-grease/signet
- install
- zapstore.dev or any Zapstore-compatible client
- topics
- #phone & sms #security
source & build
- repository
- https://github.com/digital-grease/signet
- arch flags
- android-arm64-v8a android-armeabi-v7a android-x86_64
- manifest
- missing
releases (kind 30063)
2 releases indexed; latest 0.4.0.
| version | channel | released | event |
|---|---|---|---|
| 0.4.0 | main | 2026-10-25 00:19 UTC | 2d064840… |
| 0.3.6 | main | 2026-06-13 00:54 UTC | 4dd6bf86… |
assets & verification
Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.
0.4.0 — signet-v0.4.0.apk
- sha256
- 675f7e1fe39e65b4ba067d6675efaeb58e53c9b1fe3b546bcdf7c481be79d95e
- size
- 64.4 MB
- archs
- android-arm64-v8a, android-armeabi-v7a, android-x86_64
- version code
- 40000
- apk cert sha256
- e63e48acf79918272ce4778fd1c080df09651a2ace8b9ef47516941412870ac7
- download
- signet-v0.4.0.apk
0.3.6 — signet-v0.3.6.apk
- sha256
- d5551f0aed361baa8af5fbaba72df97e120e34b181145213a3835ffb00c86716
- size
- 61.8 MB
- archs
- android-arm64-v8a, android-armeabi-v7a, android-x86_64
- version code
- 30006
- apk cert sha256
- e63e48acf79918272ce4778fd1c080df09651a2ace8b9ef47516941412870ac7
- download
- signet-v0.3.6.apk
Showing the newest 2 asset descriptors; the full set is in /api/apps/78ce6faa…