Keryx

For subscribers

Announcements from companies, without email

A company you deal with invited you to follow its announcements in Keryx, probably through a newsletter or a QR code. This page explains what Keryx is, how to set it up, and what it does and does not protect you from.

What Keryx is

Keryx is an app that receives announcements from companies: offers, product news, security alerts. The company signs every announcement, and the app checks the signature before it shows anything.

You subscribe by scanning a QR code. You do not give the company an email address, a phone number or your name, and you do not create an account. The company is not told that you subscribed.

Install the app

Web app, on any device

Open v1b3coder.github.io/keryx in your browser. It works on phones and computers, and you can add it to your home screen. On an iPhone, use the web app in Safari. There is no App Store app yet.

Open the web app

Android app

The Android app is published as a signed APK on GitHub. The easiest way to install it and keep it updated is Obtainium:

  1. Install Obtainium.
  2. In Obtainium, add an app with this source: https://github.com/v1b3coder/keryx
  3. Obtainium installs the newest release and updates it in place.
Check the signing certificate

Every release is signed with the same key. Tools such as AppVerifier can check this SHA-256 fingerprint before the first install:

5E:5A:CD:AF:31:88:49:F9:6D:C4:F5:08:A0:DA:A5:A4:74:BC:60:B2:3A:2C:63:9D:33:75:85:FF:F5:E7:C8:A1

On phones without Google services, the app uses ntfy for notifications and asks you to install it the first time you join a company.

Install Keryx only from these links. A fake app could show you anything, because the checks described here happen inside the app.

Join a company

  1. Scan the code

    Scan the company's QR code with Keryx, or open its join link. You find these in the company's newsletter, on its website, or on a receipt.

  2. Check the address

    Keryx shows a website address and asks you to confirm it. Check that it is exactly the company's own address, letter by letter. examp1e.com or example-shop.com is not example.com. If you are not sure, tap Cancel.

  3. Pick your channels

    Keryx loads the company's name, logo and channels, all signed by the company. Suggested channels are preselected, but nothing is subscribed until you tap Subscribe.

Checking the address is the only decision Keryx asks of you. Everything after it is checked by the app.

Why you can trust it

Nothing about you to leak

No email address, no phone number, no account. The company keeps no list of its subscribers, so there is no list to steal.

Every message is signed

The app checks each announcement against keys the company published on its own website. A message that fails the check is not shown. You never see a "maybe" warning.

No passwords, ever

This channel will never ask you for a password, a seed phrase or a code. Announcements are one way: you cannot reply, and the app removes forms and scripts from every message. Links show where they really go.

Open source

The app and the protocol are public under the GPL-3.0 license at github.com/v1b3coder/keryx. Anyone can read how the checks work.

To leave, turn off a channel or remove the company in the app. Removing a company deletes its messages from your phone. You do not have to ask anyone.

What Keryx does not protect you from

The moment you join

You trust the company's website address once, when you confirm it. If you confirm a look-alike address, or an attacker controls the company's website at that moment, you subscribe to the attacker. That is why checking the address matters.

An attack on the publishing service

The company may publish through a hosted service, like the one that runs this site. The service cannot write a message your app accepts on its own, because signing needs keys held by the company's own staff. But an attacker who took over the service could hold back or remove messages, and could send modified software to the company's staff to capture a signing key the next time they publish.

If something changes

If a company's keys can no longer be verified, the app stops showing its messages and warns you. It will not ask you to scan a new code, because after a website takeover that code could come from the attacker. The app offers to remove the company instead.

Your own phone

Someone with access to your unlocked phone, or malware on it, can read the messages stored there.

Connection data

To check for news, the app downloads files from the company's servers. Like any website visit, those servers see your IP address and the time. They get no name, email address or account to connect it to.