Gandalf blew Galadriel's cover?!

[tar-ancalime]

I don't know exactly how strong both cities were, but why didn't he attack them and recover at least two of the three?

It has always been my understanding that it was the power of the Rings that kept Rivendell and Lorien safe. Neither could have withstood a determined onslaught (as is pointed out at the Council when it is suggested that the One Ring be kept "safe" in Rivendell), but with the Rings' protection both could have resisted for long enough to draw Sauron's resources away from any other battle he wished to fight. It wouldn't have been in his best interest to attack Rivendell or Lorien (thus facing the power that, as Formendacil points out, he surely knew was there) without his One Ring.

Regaining the One had to be his focus.

Could it be that the reason why Elrond and Galadriel talked about the fading of the Three if Sauron should regain the One was that with the One he'd be better equipped to attack them? Perhaps the power of the Three would not be diminished at all, but Sauron's power would be so increased that he could attack them with relative impunity.

I agree that the locations of at least Nenya and Vilya were at best open secrets, at least among those who cared to study such things. I would imagine also that Sauron had a pretty good idea of Narya's whereabouts--even if he first assumed it was with Cirdan in the Havens, his second guess would be likely correct, as there were not so many very powerful figures opposing him.