“Somewhere you are” seems to be a very reasonable authentication factor in 2012. A few weeks ago my Android’s Google Maps app prompted me to turn on my Wi-Fi to better locate me. My GPS was on and had a good location but Google was going the extra mile (or better stated – extra meters) by triangulating local Wi-Fi signals (Street View collected that for a reason).
So if Google wants to authenticate me based on my location compared to my typical routine they probably will have a valid factor for 90% of my trekking around this planet.
My gasoline pump asks for my Zip Code to process my credit card. My Zip Code is the same as that of the querying pump so it seems potential exists in that use case too. I know that typically the Zip Code question is "Something you know" but think about the actual location and likelihood it is me especially considering we are collocated in the same Zip Code and I have been there many times before.
Other factors will probably similarly be added with the changes in technology and virtual presence. “Something you do” might be one for example. My typing rhythm and keyboarding differs from many (e.g. lots of backspaces).
I am sure there will be some opportunities for factors in 10 years that we cannot conceive of today just as my Google Maps Android tracking was unconceivable to me 10 years ago.