while we're at it and throwing stuff around as if its an easy fix: lets stop using passwords. Use keys. Use a trust model on these keys. So many advantages.. you don't receive the cleartext password no more (because really I DONT CARE if you use triplezscrypt.. SINCE YOU GET MY PASSWORD IN CLEAR TEXT during authentication.. its not like if compromises were "on the database". Its always at the application level.)

Beside it makes rotation easier, and not having to remember multiple passwords, or having a password manager, etc. a thing.

Oh wait ;) Google and others are actually attempting to make this work with U2F:

https://support.google.com/accounts/answer/6103523?hl=en (yes it works with gmail. Right. Now.)

https://www.yubico.com/applications/fido/