Mass Adoption Security: the signer is a phone you already own

Two ways to get a signer

A dedicated signing device starts life in a factory as a known product. It goes to a distributor, then to a reseller, then to a courier, then to your desk. Every link in that chain is a place where the box can be opened. The box says what it is. The route is short and known. And somewhere along the way your name, your address and the fact that you hold crypto end up in a customer database.

A phone takes a different route. It travels with a billion other phones through the same shops, and nothing about it says "signer" until you make it one. Nobody can know in advance which phone that will be, so there is no shelf to tamper with and no list to leak. You can buy it anywhere, for any reason, in cash, or simply use the one you retired last year.

We call this Mass Adoption Security. The safest device to ship is the one people already have. The device people most reliably set up is the one they already own. Nobody buys anything, nobody goes into a database, and there is no reseller to subvert.

What a phone has that a box does not

A screen. Six inches, high resolution, touch. There is room for a full address, a decoded contract call and a warning in plain words. Blind signing is, to a large degree, a screen-size problem, and a phone does not have it.

Radios and a camera, already in the box. Camera for QR codes, Bluetooth LE for the desk, NFC for a tap. Three ways across the gap without buying an accessory.

Better hardware than its reputation. Modern Android phones have a hardware-backed keystore and verified boot. AirNox Vault refuses to create its vault on a device where the wrapping key does not land in secure hardware. On supported models that hardware is a certified security chip.

An open platform. You can run GrapheneOS, with its network permission toggle and hardened memory allocator. The app runs with or without Google services, on stock Android or a hardened build.

Anonymity. On a desk it is just a phone. It is on nobody's list of people who hold crypto.

The install is boring on purpose

The phone never goes online, not even to fetch the app. Pull the SIM. Reset the phone. Never give it a Wi-Fi password. On a computer, build the APK yourself or download our signed APK, from us or from an app marketplace. Copy the file to the phone over a cable yourself. If it is our APK, check its signature against the one we publish. Then put the cable away.

The app itself has no internet permission in any build, so the operating system refuses it a socket. Backups are off. Secret screens are excluded from screenshots. The app locks itself when idle and after repeated wrong passwords. The signing code is the same core the desktop uses, so there is one implementation of each chain to audit, not two.

Trust moves from the box to the build

With a dedicated device you trust a sealed box and a vendor's firmware. With AirNox Vault you trust a build you can read. The app is open source. The trust moves from something you cannot inspect to something you can, and a build is something open source can answer for.

The honest trade-offs

A phone has a larger attack surface than a single-purpose device. That is exactly why this one must never go online. Airplane mode is a software switch, so take the SIM out and never enter a Wi-Fi password. Keep the phone single-purpose: this is not the device for social apps.

No phone's secure chip signs with the curves blockchains use, so the chip protects the key that seals the seed while the signature itself is computed in the app's memory for a moment. On a device with no network and no other apps, that is an acceptable trade, and it is the same trade most dedicated devices without a dedicated signing chip make.

And the app reaches the phone through the computer we assume is compromised. Android checks the app's signing certificate on every install. Compare the fingerprint with the one we publish, from a second device if you can, and if they differ, stop.

Those are the limits. Everything else about the phone is an advantage.