They should. Could also do what Facebook (optionally) does: require you to send them a 4-digit code via your phone to allow access to any new unrecognized devices.