I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this account.
The two-factor authentication Google offers seems like a good idea for that, but I don't see how it could protect against someone gaining access to my phone. The phone still needs to use an application-specific password, which would allow an attacker to access my account.
What strategies exist to defend against such a scenario? The smartphone looks like an obvious weak link in this situation. How can one make it harder for someone to gain access to it to also access the Gmail account?