If he's cautious enough to do two-factor auth, he probably doesn't leave his accounts logged in. Plus you have a whole lot of other problems if someone owns your personal machine.
If he's cautious enough to do two-factor auth, he probably doesn't leave his accounts logged in.
Suppose he uses http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... and has it remember the second authentication for 30 days (available from a checkbox). Then someone who has compromised his machine and has installed a keylogger can find it password, and log back in as him from that machine when he is not there. Two-factor has not saved you. Nor has the IP check.
And yes, you're right. If someone owns your personal machine you have a whole lot of other problems. This fact makes discovering that someone owns your machine more important, not less.
Facebook could do a facial recognition match to see if you match your profile picture ...
Wouldn't work. A hacker could just hold a picture of you up to the camera.
An IP based check won't help you there. This canary would.