Two factor authentication solves most issues.
Ideally we would be using more than two, but that is what the web is currently built around. Enforcing the use of not only a password, but that with something the user has (a smartphone/tablet), security for the respective account is increased. Not only does the attacker have to breach the account, but also the portable device.
Steam, a gaming platform, allows users to tie their account to a mobile token. This generates a one time series of characters and numbers that must be entered when logging in.
Google uses it's own system, the Google Authenticator, which is leveraged off a Time/HMAC based One-Time password system.
While most attacks on the internet are done from a very remote location compared to the user, a hardware token does not solve the problem that a local attacker could simply enter the code. This is where biometrics come into play, but aren't integrated into the public internet as of yet.
Web Links:
https://support.steampowered.com/kb_article.php?ref=8625-WRAH-9030
http://www.techrepublic.com/blog/google-in-the-enterprise/use-google-authenticator-to-securely-login-to-non-google-sites/