Google has launched a new security feature in its Chrome browser designed to combat an escalating form of account takeover attacks. The feature, called device-bound session credentials (DBSCs), leverages hardware-based encryption to protect user sessions against cookie theft.
Session cookies are unique identifiers that websites store in browsers to verify users have already authenticated themselves, allowing faster browsing without repeated credential entry. However, these cookies have become attractive targets for attackers, particularly as websites have strengthened security through two-factor authentication and passkey systems. When traditional account takeover methods become ineffective, attackers have increasingly turned to stealing session cookies via malware or network interception, then using those cookies to impersonate legitimate users.
DBSCs address this vulnerability by storing a cryptographic key within specialized hardware built into devices. On Windows machines, this uses the Trusted Platform Module (TPM), while Apple devices employ secure enclaves. When a website sets a session cookie through a DBSC-enabled browser, any use of that cookie must be authenticated using the private key stored within this hardware. Because these hardware components are designed to prevent key extraction, attackers cannot sign authentication challenges even if they obtain the cookie itself.
The feature is currently available in Chrome version 147 for Windows and version 150 for macOS, though only for a limited subset of users as Google conducts testing. Users can verify activation by accessing developer tools and checking the application tab. Industry experts view DBSCs as a significant advancement in eliminating reliance on shared secrets that attackers can easily compromise. Adoption by other Chromium-based browsers is anticipated but remains uncertain.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI