Use localStorage in the browser, this is a reasonable solution which requires no usage of cookies. The passphrase is stored in the users local browser.
LocalStorage is replacement for Cookie. It's not safe. You can read the content of localStorage by using third-party local program or manual using browser tools.
Can you tell exactly how Ripple uses the localStorage?
The point of using localStorage and public key cryptography is to mitigate against MITM and replay attacks, cookie/session jacking, and keep the application stateless.
The "third-party local program" argument is invalid because a malicious third party local program can read a passphrase input in to a web page also.
I think code examples are already open source, or you can just go to the ripple client and look at the code. Many other things use this method too, it is proven.