The "korean bank" use-case

Just to get the discussion going...

in case devices are in scope you should know that the

GlobalPlatform Card Specification 2.2.1
http://www.globalplatform.org/specificationscard.asp

is well over 300 pages and in turn refers to 500 pages+ of additional information.

IMO, this is also the reason why the *current* smart card technology is unsuitable
for browser integration.

FYI, I recently tested the JRE 1.6 standard library "javax.smartcardio.*" and found
that it worked extremely bad on the 3 platforms I tried it on.

As often pointed out, smart cards *do* work with certain combinations of operating
systems, readers and middleware but as a foundation for consumers it simply doesn't
cut  it.

I.e. my quest for a simpler "web token" is a more realistic take on this topic in spite of
the fact that you need new hardware.

Anders