Google has implemented a new security measure in Chrome called device-bound session credentials (DBSCs) designed to prevent account takeovers that exploit stolen session cookies. The feature stores a unique encryption key within specialized hardware security components built into devices—specifically TPMs on Windows machines and secure enclaves on macOS and iOS systems.
Session cookies are text strings that websites store in browsers to maintain user login status, allowing faster browsing by eliminating the need to re-enter credentials repeatedly. However, as users increasingly adopt stronger authentication methods like two-factor authentication and passkeys, attackers have shifted their tactics. Rather than attempting traditional phishing, they now use infostealer malware and man-in-the-middle attacks to steal session cookies, which they then use to gain unauthorized access to accounts.
DBSCs counteract this threat by requiring session cookies to be cryptographically signed using a private key stored securely in device hardware. The key remains isolated within the TPM or secure enclave in a way that prevents extraction, even if an attacker obtains the session cookie itself. According to security researcher Scott Helme, attackers cannot forge the required signature without access to the private key, rendering stolen cookies useless.
Currently, the feature is available only in Chrome version 147 for Windows and version 150 for macOS, and only for a limited group of users as Google tests the technology. Users can verify whether DBSC protection is active by checking developer tools for a “device bound sessions” indicator when logged into supporting websites.
The implementation represents a broader shift away from shared secrets toward public-key cryptography for authentication, a model also used by passkey technology. While it remains unclear whether other Chromium-based browsers will adopt DBSCs, industry adoption is considered likely.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI