Question: My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.

Most importantly, they introduced a rather unusual (I’ve never seen this before) identification method, which they call the ‘electronic certificate’. Basically, you have to go to the bank in person and the guy gives you a tiny, cheap USB stick with a very low capacity. From this point, you’ll be required to plug the stick into your computer every time you want to log in. The stick alone is not enough, you also have to type your password — basically, 2-factor-authentification with a USB device being the second factor.

**How can this possibly work?** Of course, I believe the USB stick to contain certificates/encryption keys of some kind, that are used in the login process, but they don’t require the user to install any software on the machine. I find it rather creepy that a website accessed from a sandboxed web browser, with no plug-in/module/app/toolbar installed whatsoever, can see the USB stick you just plugged in. And not only *see* this stick, but read it and use its content deeply enough to log you to the most sensitive level of your online banking app.

I am not a big fan of plugging unknown devices into my computer to begin with, and my warning light flashed when this was explained to me, so I went for another identification method (you can choose). I’m just curious.

PS: the measure obviously does not apply to their mobile apps, since smartphones don’t have USB ports, but that’s not a big deal because you cannot do much with their phone app (it's mainly a consultation app, not something you can actually make big payments/transfers with).

Edit: no open file dialog is used, which would make the explanation quite clear.

Answer: 
It's most likely a device that pretends to be a keyboard and is thus recognized by any OS without requiring special drivers. Internally, it would probably use HOTP (or TOTP, if it had an RTC chip and a battery) and just "type" the OTP each time the button is pressed, like a [Yubikey](https://www.yubico.com/products/yubikey-hardware/) or similar U2F device.

The browser doesn't talk nor know the USB is there; it just instructs the user to press a physical button on the device (to tell the device to "type" the code, as the browser itself can't talk to it) and then interprets whatever keystrokes (up to the length of the code) it receives as coming from the device.
Sounds like a theoretical idea I had about a decade ago.

Pretty much every OS supports USB network devices. Your USB stick may pretend to be a network card, connected to a a local network, with a webserver on that network too. That webserver can have HTTPS certificates, too.

Your webbrowser can make HTTPS requests to that webserver, and discover that the USB stick and bank website trust eachother. This isn't considered a sandbox escape, because neither the browser nor the OS know that the webserver is actually on the USB stick.

IP warning: to the best of my knowledge, my former employer holds a patent on this idea in most jurisdictions. Contact a patent attorney before copying this idea.