Hot answers tagged hardware
I would then suggest Yubikey ( http://www.yubico.com ). Yubikey is a OTP hardware token that does pretend to be a keyboard (Thus requiring NO extra software installation), and then sends a 128 bit encrypted secret to the server. The tokens are fully programmable by the administrator, and its possible to use the token in a variety of ways. You could either ...
An RSA token might be another option. This requires the user to enter an OTP which is displayed on the RSA token. Works well but is not inexpensive.
In addition to sebastians answer you might also consider not using yubicos backend server but to run your own system, so that the authentication request is not forwarded to yubico but handled on your own system or within your own (your customers) subnet. Alas, you need to install/run such a backend system. Yubico themself provide an authentication server but ...
The CryptoStick uses the Web Cryptography API to expose a keys to the browser. Its likely that the proposed USB security token product product would use a similar technique. CryptoStick is open source, so it is easy for 3rd parties to verify it's security. The 2-factor authentication that I use regularly is Google Authenticator, which makes it very easy ...
Only top voted, non community-wiki answers of a minimum length are eligible