> the concept of the username/password is still so prevalent

How can you improve on it? You have the identity part and the auth part. What is better than that?

What is really crazy is that things that should be just an application locally installed on the device (such as PowerPoint) need a login at all.

There's a secondary issue of schools pushing children to use proprietary applications when perfectly serviceable alternatives exist (especially for school level work).

How the hell we all normalized this crap is maddening.

Username/password is the easiest way to log in, assuming there is no stupid format requirements. It's just two strings stored in your password manager. The most retarded way to implement log in is actually magic email link, which requires opening your email client, waiting for the email to arrive, and copying the code. If you want to make it even worse, you can require that to be done using the same browser that is trying to log into the account.

When was the last time that happened to a Gmail account? It has unlimited cookie sessions.

Then connect the browser directly to the secure element of the device, so the session cookie is cryptographically signed by something you are physically in possession of.

Logging and alerting the user that their account is being used from a new context and requiring reauthentication when accessing the account from an unfamiliar IP/user agent would mitigate this to some extent.

TPMs / secure enclaves can (in theory) prevent sessions or cookies from being stolen. Not claiming there aren't other attack vectors though.

The alternative is offering offline versions of apps to students and allow students to open downloaded items off the cloud locally. It also means students don't require internet access when off campus.

I'll take that risk, especially since I've basically never heard of a successful attack hinging on a stolen session cookie being used for months. Either you do what you'll do within a few minutes, or you never do.