Right so I'm developing very private systems recently, and I'm looking into admin login protection. I'm a PHP dev with essential knowledge of js/jq. While I handled most of the stuff so far, I'm looking to protect the login process itself. Now, from what I understand, only internet explorer is allowed to hook into a device (say a CD or a thumb drive) and check for file, only to allow login afterwards, so I'm looking into something that I can actually use. So my idea was a chrome extension, developed internally and unpublished, that would perform something rather complex and thus protect the login page. So I could have a blank login page, or one filled with spammy adds with no login form anywhere, yet by clicking the extension, I'd be able to login.
Also, I'm looking for ideas, not necessarily code, and while I understand it's a generic question, I haven't been able to gather much data on this as the search for "chrome extension protected login" and similar can be quite misleading.
One other thing I found to be cool, but unsure if it's usable, is an NFC tag. In theory, you'd have the website check NFC receiver connected to the PC, if it finds a specific device on top of it, lets you login, otherwise, it doesn't. Just an idea. Considering the environment from which you login is pretty controlled (it's always a PC, always windows, always Chrome, always same country), feel free to hit me with any ideas how would you solve this. Without investing a whole lot of money if possible.