should authenticator layer send hashed or unhashed rpId to authenticators?

[equalsJeffH]

see: #154 (comment) where @leshi wrote:

Should authenticatorMakeCredential and authenticatorGetAssertion as defined in this specification send the hashed or unhashed rpId?

see also: #176

[vijaybh]

Sending unhashed rpId would sure make it easier to show UI on the authenticator. OTOH the transport may become more complex.

[rlin1]

Note in section 1.1.2 we already assume the rpId to be passed to the authenticator: User sees a discreet prompt or notification, "Sign in to example.com."

[rlin1]

So if we would decide to only send hash(rpId), we would need to change that (note in section 1.1.2, see above)!

[AngeloKai]

What is the benefit of sending a hashed rpId? What kind of attack are we avoiding here? Passing an unhashed rpId allows for a UI that gives user more relevant information about what their gestures are meant for and ultimately helps user make more informed decision.