It all depends on your target user base.
For example, in Finland, almost all official government computers† (especially ones used to access sensitive information) have two-factor authentication (password and an ID card). In these cases, then go ahead, use some Java applet/ActiveX/Silverlight/Flash solution to provide extra authentication using these peripherals.
In most situations, you're talking about a home user using your web application/service. Biometrics and ID cards and whatnot cannot be relied upon.
So what are the alternatives?
Along with SMS or alternative email with a security question, I suggest testing the user's knowledge of their account with a reasonable margin of error while keeping it as user-friendly as possible. It can be a multi-stage test like this:
1- Choose the friend with whom you chat the most (applies to socialnetworking sites)
2- How many times do you think you've logged in this week? (applies to almost any web service)
3- How many times have you played FarmExpert on our website? (ask about something the user has never used)
† Can also be computers used by bank employees.