Question: My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.

Most importantly, they introduced a rather unusual (I’ve never seen this before) identification method, which they call the ‘electronic certificate’. Basically, you have to go to the bank in person and the guy gives you a tiny, cheap USB stick with a very low capacity. From this point, you’ll be required to plug the stick into your computer every time you want to log in. The stick alone is not enough, you also have to type your password — basically, 2-factor-authentification with a USB device being the second factor.

**How can this possibly work?** Of course, I believe the USB stick to contain certificates/encryption keys of some kind, that are used in the login process, but they don’t require the user to install any software on the machine. I find it rather creepy that a website accessed from a sandboxed web browser, with no plug-in/module/app/toolbar installed whatsoever, can see the USB stick you just plugged in. And not only *see* this stick, but read it and use its content deeply enough to log you to the most sensitive level of your online banking app.

I am not a big fan of plugging unknown devices into my computer to begin with, and my warning light flashed when this was explained to me, so I went for another identification method (you can choose). I’m just curious.

PS: the measure obviously does not apply to their mobile apps, since smartphones don’t have USB ports, but that’s not a big deal because you cannot do much with their phone app (it's mainly a consultation app, not something you can actually make big payments/transfers with).

Edit: no open file dialog is used, which would make the explanation quite clear.

Answer: 
> 
> ....they don’t require the user to install any software on the machine.... 
>  I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted by default 
> 
> 
> 

Yes, that should definitely not be possible without smartcard drivers.
This is a fundamental security mechanism of any browser.
What gives the clou that the certificate is read without clicking an "open file" dialog, a Java dialog or pre-installing drivers? You said you chose another verification option.

This sounds like the USB key used, for example, by the Bank Of China. [Such technology is described here.](http://www.icbc.com.cn/icbc/html/e_guanggao/udun/udun_e.html)

> 
> was said to be compatible with "any device that has a USB port"
> 
> 
> 

Having a PKCS#11 cert, or a #12 to combine with a passphrase will work on all OSses.
This is the same way password managers like keepass work, combining something you know with something you have to get 2 factors of authentication.
It's most likely a device that pretends to be a keyboard and is thus recognized by any OS without requiring special drivers. Internally, it would probably use HOTP (or TOTP, if it had an RTC chip and a battery) and just "type" the OTP each time the button is pressed, like a [Yubikey](https://www.yubico.com/products/yubikey-hardware/) or similar U2F device.

The browser doesn't talk nor know the USB is there; it just instructs the user to press a physical button on the device (to tell the device to "type" the code, as the browser itself can't talk to it) and then interprets whatever keystrokes (up to the length of the code) it receives as coming from the device.