Question: My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.

Most importantly, they introduced a rather unusual (I’ve never seen this before) identification method, which they call the ‘electronic certificate’. Basically, you have to go to the bank in person and the guy gives you a tiny, cheap USB stick with a very low capacity. From this point, you’ll be required to plug the stick into your computer every time you want to log in. The stick alone is not enough, you also have to type your password — basically, 2-factor-authentification with a USB device being the second factor.

**How can this possibly work?** Of course, I believe the USB stick to contain certificates/encryption keys of some kind, that are used in the login process, but they don’t require the user to install any software on the machine. I find it rather creepy that a website accessed from a sandboxed web browser, with no plug-in/module/app/toolbar installed whatsoever, can see the USB stick you just plugged in. And not only *see* this stick, but read it and use its content deeply enough to log you to the most sensitive level of your online banking app.

I am not a big fan of plugging unknown devices into my computer to begin with, and my warning light flashed when this was explained to me, so I went for another identification method (you can choose). I’m just curious.

PS: the measure obviously does not apply to their mobile apps, since smartphones don’t have USB ports, but that’s not a big deal because you cannot do much with their phone app (it's mainly a consultation app, not something you can actually make big payments/transfers with).

Edit: no open file dialog is used, which would make the explanation quite clear.

Answer: 
One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect to claim that "it works in any device that has a USB port, Windows, Mac, Linux and more, and to work out of the box". 

Did they claim that it works in any browsers or just any OS?
It's probably just a USB smartcard reader, with inserted SIM sized smartcard. 

Manual installation of drivers is not needed since at least generic drivers for both reader and card are already installed in most modern OSs.

See the image below for example of such device:

[![Photo of USB device.](https://i.stack.imgur.com/Z3Ysw.jpg)](https://i.stack.imgur.com/Z3Ysw.jpg)

There is certificate with private key stored on that SIM smartcard inside reader. When you plug it in the computer, that certificate from smartcard gets loaded into OS certificate store. From there on it basically behaves just like any other certificate which is saved on computer and can be used for accessing secured resources, signing documents/mail, encrypting stuff, etc.

This one in particular is issued by Cert Authority which is trusted by my bank (web banking) and State (mostly used by me for IRS related stuff and requesting real documents).