[webauthn] Refer android-safetynet verification to SafetyNet documentation? (#1135)

emlun has just created a new issue for https://github.com/w3c/webauthn:

== Refer android-safetynet verification to SafetyNet documentation? ==
@arnar notes in https://github.com/w3c/webauthn/issues/1132#issuecomment-454998300:

> I wonder if it's best to simply refer to [SafetyNet documentation](https://developer.android.com/training/safetynet/attestation#verify-compat-check) on this, rather than chasing any potential changes there.

I believe this has been suggested off-hand before, too. We've had several inaccuracies in the verification steps copied into WebAuthn: #968, #1018, #1132.

Should we delete the [android-safetynet](https://w3c.github.io/webauthn/#android-safetynet-attestation) verification procedure from WebAuthn and just refer to the [SafetyNet documentation](https://developer.android.com/training/safetynet/attestation#verify-compat-check) instead?

Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1135 using your GitHub account

Received on Thursday, 17 January 2019 11:45:16 UTC