I have been learning about the new Web Authentication specification. I am a little confused as to how the following use case would work:
A user wants to login to an enterprise web application on their laptop or desktop, using their smart phone as an authenticator (as defined in the spec).
To clarify... the user would type in their username in the web application running in the browser on their laptop. They then click a button that says something like "Password-less Login With Smartphone". They would then click this button at which point they would be prompted on their smartphone for a fingerprint scan. Upon a successful scan they would be logged in to the site. This flow is outlined as an example workflow in the specification here. Also, Google did a nice presentation where they gave an example of something similar except that the web application they were running was already running on the smart phone (not a desktop or laptop). See here. I am interested in the use case where a user is running a web application on their laptop or desktop and want to use their smart phone as the authenticator.
This leads me to the following question(s):
At a high level, what is the process for setting up a smart phone as an authenticator? Is it possible to do this? Is this a use case that Web Authentication supports?
What I am looking for is a very high level of how somehow should setup the browser to interact with their smart phone the same way it would when using Yubikey or another similar device. All of the examples I have seen use Yubikeys or other USB devices as the authenticator for this particular use case, not a smart phone. Any insights would be helpful.