Well that was the promise of OAuth. But then that service company (in this case Google and Facebook) have full and perfect visibility on all the websites you use which raises some other problems. Which is why I never wanted to touch it and why I think they are not so popular.

What I really like is concepts like Steve Gibson's SQRL, which provides a pretty secure alternative to passwords, but in a fully decentralised way, i.e. SQRL only provides the protocol and the cryptography, but the authentication only involves you (and your devices) and the website, no reliance on a third party.

Why is it a no-brainer? Consider their perspective - it'll cost money, their customers won't thank them, and in fact will probably be frustrated by the experience, and it won't enhance shareholder value.

I can't see why they would.