Re: [webauthn] explain challenge's security importance and use in both registration and authentication operations

wrt [the examples (aka "sample scenarios"):](https://w3c.github.io/webauthn/#sample-scenarios)
```
var challenge = new TextEncoder().encode("climb a mountain");
```
perhaps ought to be:
```
// server generates 32 byte random challenge value, memorizes it for validation of the upcoming 
// response, base64-encodes it, and sends it to client as part of the web page running in the user 
// agent, who then turns it back into a byte array thusly:
var challenge = window.atob("PGifxAoBwCkWkm4b1CiIl5otCphiIh6MijdjbWFjomA=");
```
this is applicable to all the examples in this section. 








-- 
GitHub Notification of comment by equalsJeffH
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/404#issuecomment-294236973 using your GitHub account

Received on Friday, 14 April 2017 21:07:54 UTC