WoW and gmail and other 2-factor authentication use the simpler method, 2-factor authentication using a shared secret that isn't passed over the wire (the seed for a PRNG). However, this method is still vulnerable if a hacker gains access to the seeds on the host computer. This is what happened to RSA recently and it's a very bad thing when it happens.
What I was talking about was something different. Public/private key encryption where only the public key is stored on the server.
Here's an example scenario: the server generates a random pass-phrase then encrypts it using the public key. The end-user then uses their smartphone where the private key is stored to decrypt the message and return the original pass-phrase back to the server, proving they have the private key. There are similar ways of achieving a similar result that are less cumbersome and awkward. The advantage is that if the public key is leaked it's not a big deal, it can't be used to gain access to the system.