In the end, two factor auth is all about (a) having a password, and (b) having physical access to a device. If you are giving someone unsupervised access to your computer while logged in as you, part (b) is compromised anyway, in a different manner.
To answer your question, though:
- You can put a unique GUID in a cookie
- You can put another GUID in
- You can associate part of the browser User-Agent request header with the account. For example, my User Agent is
User-Agent:Mozilla/5.0 (X11; Linux i686) AppleWebKit/536.11 (KHTML, like Gecko) Ubuntu/12.04 Chromium/20.0.1132.47 Chrome/20.0.1132.47 Safari/536.11. From here, you can extract my browser name (which won't change), OS name and version (which will change occasionally), whether or not my computer is 32 bit, etc.
navigator.plugins -- This is an array of all the plugins installed on the browser. Maybe not a good idea for 2 factor authentication, though, since this changes often.
Note that all of these can be easily spoofed. It's just extra hoops for a would-be hacker to jump through.
Edit: As Joel mentions in the comments, you should also have a way of revoking "trusted computers" (simply dissociate the GUID in your database). And this should apply when the password is changed as well.