SecurityQuiet 92d · day 92
Chrome rolls out device-bound session credentials to stop account takeovers
Google's new DBSC feature stores authentication keys in hardware to prevent stolen cookies from being exploited.
What to know
- Chrome now uses device-bound session credentials (DBSCs) to lock private authentication keys in hardware, preventing attackers from exploiting stolen cookies.
- The feature stores keys in TPM or secure enclave so that even if a cookie is stolen, attackers cannot sign authentication challenges without the protected private key.
- Currently rolled out to limited users in Chrome 147 (Windows) and 150 (macOS); wider deployment timeline unclear.
“The attacker can't steal the private key from the device because the TPM / Secure Enclave will not release it. That is the core protection here.”
Scott Helme, Security researcher · Ars Technica
Google Chrome developerScott Helme Security researcher and founder of Report URI
The record 1 articles and posts · last 30 days