My company is developing a web application, and I was asked to research how to do hardware-based token authentication to login into our web application. Let me repeat: basically there will be a web app, and there will be a usb of sort to be connected to the computer, may be user will need to enter user name & password somewhere and provided that user name & password is correct, user should be authenticated to use our web application. Of course we don't want user to download/install anything on there machine because the machine might not be theirs or they just don't want to do anything extra. My company suggested having a browser plugin, but since the plugin has whatever the system rights the browser has or less, and a browser should not be able to access the underlying hardware (except for camera & microphone since they are essentials)
One way I see how to do it is probably to have a modified version of a web browser which at the same has the ability to check if the security token (the usb) presents, then start the web app from there. If users don't want to run anything or the target computer doesn't allow running this sort of thing, I think doing this is impossible. Just want to check with you guys if I'm missing something.