Pinning the cookie to the IP is not practical. Imagine a mobile phone that is constantly switching networks.
I heard about pinning the cookie to the SSL session keys in high security applications. The server would allow a specific cookie only if it comes over the specific SSL session that was used to initiate that cookie.
A different way of making the cookie unusable on a different computer is fingerprinting the original computer. The combination of, OS, browser, screen resolution, installed addons, can form a unique fingerprint that identifies one computer.
The "remember me" functionality is for convenience. Convenience is almost always at odds with security. Imagine using voice recognition in your office to conveniently input passwords and the second factor. Multi factor decreases convenience and increases security.
In fact, multi factor authentication asks for multiple inputs from the user while the "remember me" is used to ask for less inputs. You are asking for something that increases security and convenience. That is where research into new authentication is currently applied. Biometrics, personal devices and other technology is working toward that goal.
- Services la LastPass and KeyPass can provide the illusion of the "remember me" and still have heightened security.
- Google is working on a ring and a technology that uses your smartphone and inaudible sound to authenticate the user.
- YibiKey is a hardware device that can eliminate remembering and typing of passwords.