Question: My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.

Most importantly, they introduced a rather unusual (I’ve never seen this before) identification method, which they call the ‘electronic certificate’. Basically, you have to go to the bank in person and the guy gives you a tiny, cheap USB stick with a very low capacity. From this point, you’ll be required to plug the stick into your computer every time you want to log in. The stick alone is not enough, you also have to type your password — basically, 2-factor-authentification with a USB device being the second factor.

**How can this possibly work?** Of course, I believe the USB stick to contain certificates/encryption keys of some kind, that are used in the login process, but they don’t require the user to install any software on the machine. I find it rather creepy that a website accessed from a sandboxed web browser, with no plug-in/module/app/toolbar installed whatsoever, can see the USB stick you just plugged in. And not only *see* this stick, but read it and use its content deeply enough to log you to the most sensitive level of your online banking app.

I am not a big fan of plugging unknown devices into my computer to begin with, and my warning light flashed when this was explained to me, so I went for another identification method (you can choose). I’m just curious.

PS: the measure obviously does not apply to their mobile apps, since smartphones don’t have USB ports, but that’s not a big deal because you cannot do much with their phone app (it's mainly a consultation app, not something you can actually make big payments/transfers with).

Edit: no open file dialog is used, which would make the explanation quite clear.

Answer: 
It's most likely a device that pretends to be a keyboard and is thus recognized by any OS without requiring special drivers. Internally, it would probably use HOTP (or TOTP, if it had an RTC chip and a battery) and just "type" the OTP each time the button is pressed, like a [Yubikey](https://www.yubico.com/products/yubikey-hardware/) or similar U2F device.

The browser doesn't talk nor know the USB is there; it just instructs the user to press a physical button on the device (to tell the device to "type" the code, as the browser itself can't talk to it) and then interprets whatever keystrokes (up to the length of the code) it receives as coming from the device.
As some of the other answers mentioned, this is most likely a USB security token. Think of it as a smart card reader + embedded smart card (and sometimes they are actually implemented this way). Think [CAC card](https://en.wikipedia.org/wiki/Common_Access_Card) used by US defense organizations. Think PGP card. Some Yubikey models also support acting as a smart card.

This kind of devices is widely used by banks in China to protect their online banking website / desktop client software, and my answer is mostly based on my personal experience using these tokens in China.

How do you use it?
------------------

When you sign up for online banking and opt for a USB token, the bank gives you the token, creates a public/private key pair and your personal certificate, and load those into the token. You set a password on the token, which is separate from your online banking login password.

You install the driver provided by the bank on your personal computer, plug the token in, and navigate to the bank's website. Whenever you log in or perform a sensitive operation (transferring funds, changing contact information, authorizing online purchase, etc.), the browser / operating system prompts for your token password, the light on the token blinks for a few seconds, and the transaction goes through.

Wait, I have to install drivers?
--------------------------------

Yes. The Windows operating system has a standard smart card interface, but each model of USB token still requires a driver. Very rarely, Windows Update will install the correct drivers for you, but in most cases you will have to download a package from the bank's website.

Often the only supported operating system is Windows, and the only supported browser is IE. (They like them some ActiveX.) It is certainly possible in general for smart cards / USB tokens to support other OS / browsers, see CAC card above; you have to check compatibility with your own bank.

So how does it authenticate you?
--------------------------------

The browser asks the OS to ask the token to sign a small piece of data (perhaps your transaction details). The token signs it, using your private key and certificate. The browser sends the signature to the bank. The bank verifies the signature, and is satisfied that only the token they gave you have the private key to produce this signature.

The private key never leaves the token. If properly designed, the token should never divulge the private key.