Well, yeah, but what does two-factor auth help with any of that? Ending all existing sessions when you change the password doesn't require a second factor. Limi

Well, yeah, but what does two-factor auth help with any of that? Ending all existing sessions when you change the password doesn't require a second factor. Limiting the validity of a cookie to one country also doesn't seem to me to be much of a security feature, and more something that prevents you from using the service anonymously through Tor - the local thief won't be far from you and the botnet operator probably has more than enough systems in your vicinity to tunnel through, and in any case requiring the password would do the job equally well, wouldn't it?