Google has rolled out a new security feature in Chrome called device-bound session credentials (DBSCs) designed to combat a growing category of account takeover attacks. The feature addresses vulnerabilities that have emerged as users increasingly adopt multi-factor authentication and passkey-based protections.
Session cookies are character strings that websites store on browsers to speed up authentication processes, allowing users to remain logged in without repeatedly entering credentials. However, as traditional phishing and password-based attacks have become less effective due to stronger authentication measures, cybercriminals have shifted tactics toward stealing these session cookies through malware and man-in-the-middle attacks. Once obtained, attackers can paste stolen cookies into their own browsers to gain unauthorized access to accounts.
DBSCs counteract this threat by storing a unique encryption key in specialized hardware built into devices. On Windows systems, this storage location is called a Trusted Platform Module (TPM), while Apple devices use secure enclaves. When a website sets a session cookie, the browser must send a cryptographically signed version of that cookie using the hardware-stored key. The hardware architecture prevents unauthorized extraction of the private key, meaning attackers cannot forge valid authentication responses even if they obtain the cookie itself.
Currently, the feature is available only in Chrome version 147 on Windows and version 150 on macOS, and Google is limiting its rollout to a subset of users during the testing phase. Users can verify whether DBSCs are active by accessing browser developer tools. It remains unclear whether other Chromium-based browsers will adopt the technology, though industry observers expect widespread implementation.
DBSCs represent a broader shift in authentication methodology away from shared secrets toward systems requiring private keys secured in device hardware, similar to passkey authentication frameworks.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI