the easier answer is to leverage SSL authentication. There's no reason we should have to use passwords every time we login to a site. All sites have to do is

the easier answer is to leverage SSL authentication. There's no reason we should have to use passwords every time we login to a site. All sites have to do is generate a single device asymetric key pair and provide the one part to the client's browser (we'll call this private) and associate the other part ("public") to whatever account you care about. Now, you still need some other element to authenticate the user when they visit a website from a new device/browser, but this would mean that you don't have long term cookies that serve the same role and are therefore more extractable over the wire (as we've seen in the past) and would negate these type of attacks. Also, the tech exists in browsers today already, many SSL registrars already do it.