Bootstrap QR stays off the web

Claim: possession trust must not become a hyperlink

Meet nearby is a tunnel, not a contact. That tunnel still needs a bootstrap: enough material for the responder to find the initiator’s session and prove they scanned this meeting, not a replayed screenshot from last week.

Bootstrap includes a short-lived session id and a possession authenticator—random bytes that bind the QR to later handshake confirmation. Whoever holds the complete bootstrap before expiry can attempt to join as responder. That is intentional: physical presence (or deliberate paste) is the trust anchor for starting the session.

The claim: that authenticator must never travel as an ordinary web URL. The public form is a non-URL string:

NT2-PXP2:<base64url payload>

In-app QR display and deliberate plain-text paste inside NT² are the supported handoffs. Navigable https://…/?m=… deep links—excellent for ordinary share packages—are the wrong container here.

Constraint: URLs remember what you hoped was ephemeral

Deep links are the default web handoff. NT² uses them widely for contact invites and Mode B/C packages. They are easy to copy, open from Messages, and resolve through the vault origin.

They are also sticky.

Browser history retains capability strings. A responder who opens a bootstrap link “just to try” leaves residue in history, sync’d profiles, and shared machines.

Referrers and OS camera → URL launch paths expand the audience. System camera apps that turn QR contents into navigations are optimized for marketing URLs, not for single-use authenticators. Once the string is a URL, intermediaries treat it like a link.

Service workers, crash reports, and analytics love URL shapes. Even careful products leak query strings into places engineers forgot to scrub. A non-URL local carrier is harder to mistake for “just another ?m= message.”

Clipboard managers retain what you copy. Automatic copy of bootstrap text would widen the window. NT² never copies the capability string automatically; paste is an explicit, warned path.

If the bootstrap can live in a URL, the authenticator has already left the room’s threat model and entered the web’s.

Design: in-app possession handoff, then transcript-bound confirm

sequenceDiagram
  participant I as Initiator
  participant R as Responder
  I->>I: Fresh session id + authenticator + ephemeral key
  I->>R: NT2-PXP2 QR or deliberate paste
  R->>R: Classify as local PXP bootstrap (not URL)
  R->>I: Authenticated handshake
  Note over I,R: Transcript binds bootstrap to confirmation
  I->>I: Derive directional traffic keys
  R->>R: Derive directional traffic keys

Non-URL classification first. Receivers that understand vault messages check for NT2-PXP2: before treating bytes as a deep link. URL and other public carriers reject proximity session bootstrap rather than “helpfully” opening it. Ordinary share actions keep using https://se.nt2.me/?m=…; secret-bearing nearby bootstrap does not.

Short life. Session ids and authenticators expire. UI shows only a short suffix of the session id in normal chrome. Full identifiers are not treated as stable log keys.

Transcript-bound handshake. Confirmation ties the authenticator to the handshake transcript so a captured QR cannot be casually replayed into a different conversation shape after the fact. Spent markers and single-responder concurrency (busy if a second peer tries the same live session) keep the meeting from becoming a broadcast join code.

Directional traffic after confirm. Once both sides confirm, traffic keys and nonce prefixes are directional. Retries stay replay-safe within the session rules. On teardown—success, cancel, or timeout—session secrets zeroize.

Human-scale warnings where needed. Copy-to-clipboard requires confirmation that managers may retain the string, and that it must not be posted to public chat or email. QR remains the recommended path because it keeps the authenticator in the room.

Trade-off: lose “camera opens the vault site”

Keeping bootstrap off the web costs a familiar convenience.

Users cannot rely on the OS camera app to open Meet nearby the way it opens a marketing QR. Responders need NT²’s in-app scanner (or a deliberate paste into Receive). Support must explain “scan inside the app” without sounding broken.

We accept that friction because the alternative is teaching browsers to forget. History scrubbing is incomplete; referrer policy is incomplete; “please don’t screenshot” is not a control. A format that is not a URL removes an entire class of accidental publication.

This choice sits beside progressive disclosure elsewhere in the product: advanced or sensitive carriers get sharper edges than everyday deep links. Nearby bootstrap is sensitive by construction—it is a join capability for an encrypted meeting.

What we refuse

We refuse URL or deep-link acceptance of Meet nearby v2 bootstrap. If it navigates, it is the wrong carrier.

We refuse stuffing the authenticator into ordinary public message carriers meant for disposable inbox links. Session bootstrap is a join capability, not a share you forward in chat.

We refuse automatic clipboard copy of the capability string. Paste is explicit and warned.

We refuse logging full session ids as durable identifiers. Short UI suffixes are enough for humans; full values stay out of routine telemetry.

We refuse treating an expired or spent bootstrap as silently reusable. Possession is time-bounded.

Close: the QR is the room’s door key

Meet nearby starts with deliberate physical handoff. The door key is NT2-PXP2:…—scanned or pasted inside the vault—not a hyperlink that tours the open web before the handshake begins.

Earlier: proximity session ≠ peer connection. Next: once the session is ready, how control-plane messages and a WebRTC bulk plane deliver contact invites and Mode A attachments without inventing a second share format.

If you want in-person vault handoffs that keep join material out of browser history, explore NT² Vault.