An enrolled-device confirmation with clear limits.
CodeWords combines an in-person QR and Bluetooth ceremony with device-bound signatures for later requests. This page explains the security result without treating it as proof of a person.
Model version: 1.0. Updated 7 August 2026.
Protocol controls
What the design checks
Two keys with different jobs
Each enrolled phone creates a presence key and a separate approval key. Private keys remain in platform-protected storage where supported. The server receives public keys and signed proofs.
One live in-person transcript
The QR session carries a fresh signed offer and changes rapidly. The scanner collects multiple signed frames and completes a fresh Bluetooth GATT challenge signed by the same presenting-phone key.
Human comparison
Both phones derive the same three words and six-digit number from the connection transcript. Both people compare them before approving on their own phone.
Action-bound challenges
A later challenge names the exact action, both enrolled devices, a fresh nonce and an expiry. The requester and response are signed so a result cannot be moved silently to another request.
Revocation instead of inheritance
Only one phone may be active on an account. A changed approval key or completed phone recovery revokes old phones, sessions, relationships and pending challenges.
Layered server controls
Verified email, shared rate limits, app-integrity checks, short-lived sessions and tamper-evident audit events add protection around the device protocol.
Attack handling
How common attacks are handled
A saved QR image
The session is short-lived and the scanner also requires a fresh signed Bluetooth exchange from the QR key.
A copied Bluetooth advertisement
An advertisement is not accepted as proof. The scanner sends a fresh nonce over GATT and verifies the presenting phone's signature.
A replayed challenge response
The response is bound to one challenge hash, one relationship, the enrolled responder device and an expiry.
Login on a new phone
An account with an active phone cannot register another phone. Recovery is delayed and revokes inherited trust.
Database changes
Device signatures are checked independently and audit events are hash chained. Database access remains a serious incident and is not treated as harmless.
Known limitations
What CodeWords does not prove
- A valid result confirms control of the enrolled approval key for the exact request. It does not prove a voice, email sender, video image or legal identity.
- Bluetooth confirms a direct radio protocol exchange, not a measured physical distance. Signal strength is not used as proof, and a sophisticated real-time relay remains part of the threat model.
- The first connection is only as trustworthy as the people and devices present. Meeting the wrong person securely creates the wrong trusted relationship.
- Biometrics reduce casual misuse but do not remove coercion, malware, operating-system compromise or abuse of an already unlocked phone.
- Recovery depends on the account password, verified email and cooling period. A compromised email account is therefore a serious risk.
- CodeWords cannot decide whether a requested payment or action is wise, lawful or safe. It adds a confirmation control and does not replace judgement or organisational approvals.
Data minimisation
CodeWords stores account details, device public keys, push notification tokens, relationship records, transcript hashes, challenge state, recovery state, integrity results and security events. Push alerts contain generic event text only. CodeWords does not upload contact books, private keys, biometric templates, call audio, QR camera frames or precise location.
Report a vulnerability
Send a reproducible report to team@certifyd.io with “CodeWords security” in the subject. Do not access another person's data, disrupt the service or use coercion in testing.
Email the security team