Personally, I suspect the Right Way to do this is for W3C to standardize a special input field something like: <input type="passhash"/> which looks like a

Personally, I suspect the Right Way to do this is for W3C to standardize a special input field something like: <input type="passhash"/> which looks like a normal password entry field but automatically does some clever hashing on the client to create a per-site password. Of course, you can still get keylogged if you use a public computer or whatever.