No site should use passwords anymore in the 21st century... Most people have smart phones which can be used to verify identity even when using desktop browser or application. For mobile subscriptions with no phone number there is still offline code generators that can be used to generate verification codes. Offline code generators use camera of the phone to associate device ID of the phone with correct online account. Two-factor authentication is pretty much minimum requirement, but some sites like Facebook already use three-factor authentication to be extra secure.