Not really; you can just set a cookie that indicates that the device is trusted for 2FA. It's no more damaging than a session cookie if hijacked, can be protect

Not really; you can just set a cookie that indicates that the device is trusted for 2FA. It's no more damaging than a session cookie if hijacked, can be protected by TLS, and doesn't require any special server state. On first login: Login sends credentials, no cookie. Provider verifies credentials, doesn't have 2FA verification, sends 2FA challenge. Upon completion of challenge, provider sets session cookie + 2FA cookie. On logout, the session cookie is destroyed, but the 2FA cookie is not. On successive logins: Login sends credentials + 2FA cookie -> provider verifies credentials, verifies 2FA cookie + timestamp, grants a session cookie. This way, you can gain the power of 2FA (someone stealing my credentials won't be able to log into my account) without the hassle of it (people using stolen credentials won't be logging in on my own computer, so I can trust this computer to bypass challenges for 30 days), and you don't have to add any server state that is aware of any particular computer, save for some value which is tied to the cookie. For bonus points, the server maintains a list of 2FA cookie tokens, and allows them to be revoked, so if my laptop is stolen, I can log in on my desktop, revoke my laptop 2FA cookie, and the 2FA bypass won't work from it anymore. Slightly more work, nothing really significantly difficult, but substantial increase in usability without any real sacrifice of security.