WEB Signal 463
Chrome adopts what may be the best protection yet against account takeovers
↗
Chrome has introduced device-bound session credentials (DBSCs), which bind session cookies to a hardware-protected key so that stolen cookies cannot be replayed by an attacker.
Session cookie theft via infostealer malware and adversary-in-the-middle attacks has become a dominant account-takeover vector as stronger authentication like 2FA and passkeys close older paths. DBSCs make a stolen cookie useless without the private key locked inside the device's TPM or secure enclave. Only one feed carried this story, so the rollout scope and server-side adoption details are thin.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
DBSCs store a private key in the device's TPM or secure enclave and require the browser to sign session-cookie challenges with that key, preventing exfiltrated cookies from being replayed elsewhere.
The feature is currently limited to Chrome version 147 on Windows and version 150 on macOS, and is enabled only for a limited set of users during testing.
Whether and when other Chromium-based browsers will implement DBSCs remains unclear, though the article suggests it is likely.
THE CLUSTER