Guides
Temporary codes and QR links: risks and precautions
The code and QR represent the same temporary invitation. The design limits its useful window, while the person sharing it still controls who receives it.
Controls that are implemented
- Format
- ABC-234
- Six characters from a 31-symbol alphabet.
- Characters omitted
- I, L, O, 0 and 1
- Reduces mistakes when reading or dictating.
- Join window
- 10 minutes
- For a new, unconnected anonymous Pase.
- Capacity
- 2 browsers
- The owner and one second participant.
- Generation
- Web Crypto
- Rejection sampling avoids alphabet bias.
Threat model
The main asset is not the code by itself. It is access to the intended Pase and the file that will end up at both endpoints.
| Risk | What could happen | Current control | Practical precaution |
|---|---|---|---|
| Exposed code or QR | Someone else attempts to join during its useful window. | Only one second participant fits, and join attempts are rate-limited. | Share it privately when both devices are ready. |
| QR points elsewhere | The camera opens an unrelated site that imitates the flow. | Mándamele validates the code when a request reaches its service. | Check mandamele.com and HTTPS before entering or sending anything. |
| Wrong participant | Someone with the code joins before the intended recipient. | The protocol supports approval and rejection, but manual approval is disabled in the current flow. | Confirm the recipient by voice or another channel, and make a new Pase if anything looks wrong. |
| Compromised endpoint | The file is read before sending or after receipt. | WebRTC protects transport; Mándamele does not control either endpoint. | Avoid public devices and encrypt the file first when its impact warrants it. |
| Retained screenshot or download | The invitation or content remains outside the session. | Expiry ends Pase state; it cannot erase files or screenshots. | Close the Pase and review downloads, copies, trash and sync. |
What the QR actually contains
The QR encodes the join URL with the code in its code parameter. Scanning saves typing, but adds no separate authentication layer or encryption key. A photograph of the QR is a copy of the link for as long as the Pase remains available.
Once the Pase expires, that link no longer opens the session. It cannot recover earlier transfers either, because Mándamele does not keep a text or file inbox.
Precautions worth taking
When sharing
- Show the QR directly or use a private conversation.
- Keep it out of streams, recordings and public screenshots.
- Check the domain when a link arrives away from your own screen.
When connecting
- If the connection is unexpected, close it and generate another code.
- Do not treat possession of the code as proof of human identity.
When finished
- Close the Pase.
- Remove only the copies that no longer need to be kept.