Two factor authentication solves most issues.
Ideally we would be using more than two, but that is what the web is currently built around. Enforcing the use of not only a password, but that with something the user has (a smartphone/tablet), security for the respective account is increased. Not only does the attacker have to breach the account, but also the portable device.
Steam, a gaming platform, allows users to tie their account to a mobile token. This generates a one time series of characters and numbers that must be entered when logging in.
Google uses it's own system, the Google Authenticator, which is leveraged off a Time/HMAC based One-Time password system.
While most attacks on the internet are done from a very remote location compared to the user, a hardware token does not solve the problem that a local attacker could simply enter the code. This is where biometrics come into play, but aren't integrated into the public internet as of yet.