Question: My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.

Most importantly, they introduced a rather unusual (I’ve never seen this before) identification method, which they call the ‘electronic certificate’. Basically, you have to go to the bank in person and the guy gives you a tiny, cheap USB stick with a very low capacity. From this point, you’ll be required to plug the stick into your computer every time you want to log in. The stick alone is not enough, you also have to type your password — basically, 2-factor-authentification with a USB device being the second factor.

**How can this possibly work?** Of course, I believe the USB stick to contain certificates/encryption keys of some kind, that are used in the login process, but they don’t require the user to install any software on the machine. I find it rather creepy that a website accessed from a sandboxed web browser, with no plug-in/module/app/toolbar installed whatsoever, can see the USB stick you just plugged in. And not only *see* this stick, but read it and use its content deeply enough to log you to the most sensitive level of your online banking app.

I am not a big fan of plugging unknown devices into my computer to begin with, and my warning light flashed when this was explained to me, so I went for another identification method (you can choose). I’m just curious.

PS: the measure obviously does not apply to their mobile apps, since smartphones don’t have USB ports, but that’s not a big deal because you cannot do much with their phone app (it's mainly a consultation app, not something you can actually make big payments/transfers with).

Edit: no open file dialog is used, which would make the explanation quite clear.

Answer: 
One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect to claim that "it works in any device that has a USB port, Windows, Mac, Linux and more, and to work out of the box". 

Did they claim that it works in any browsers or just any OS?
This sounds like a Yubikey. They're well known and work great.
<https://www.yubico.com/products/yubikey-hardware/yubikey4/>

* Regarding not needing drivers: The Yubikey identifies itself as a keyboard so any machine with a keyboard driver can read the text output from it.
* How it works: You push the button and the Yubikey issues a public key (from a secure private key embedded in the device). The bank can then
authenticate you and confirm that you have the thing you know (your
password) and the thing you have (your physically secured private
key).
* Why it's secure: It's not possible for software on your
computer to get access to your private key so malware cannot copy the
key and pretend to be you. It would have to be physically stolen from you. (which is possible, but that's why you pair it with something you know)
* Who uses them and why: Google helped design the yubikey so they could
solve the problem of malware on a computer grabbing local credentials
while the user was not present. Every Google engineer has one. I've
used them for years and deployed numerous 2fa solutions around them.