AWS Multi-Factor Authentication

The software in a separate token can't be modified.

These keyfobs number generators are actually pretty interesting devices. The basic principle is that they generate a pseudorandom sequence of numbers. The starting seed of each device is different, and each device's seed is known to the authenticating server. Given the initial seed and the current time, the server can predict what is the number that the token will show.

Due to the properties of the pseudorandom algo, it is impossible to guess the seed by observing a token's digits.

And these sealed tokens self-destruct if tampered with. No, you can't change the batteries. :)

There are such systems available, e.g. http://www.google.se/search?q=authentication+sms+service

In my opinion the best solution for two-factor logins is password plus SMS challenge. It requires a device, but at least it's a device you most likely already have.

The solution might not be as useful in the US with the "pay for receiving messages" stuff, but if the service you're loggin into is important enough (bank etc) most people might not mind.

If you allow OpenID, users can choose an openid provider that has a hardware authentication option, like Verisign.

Most won't, but it at least is an easy way to provide this option.