Facebook just gave a talk at an HN London meetup recently about exactly this topic: http://vimeo.com/80460475#t=11m48s . The gist is that 2FA doesn't work because people don't enable it, but you can protect accounts by detecting anomalous behaviour on logins.