Google Chrome is introducing a new web capability called Device Bound Session Credentials (DBSC) to combat cookie theft and protect users against session hijacking. DBSC aims to disrupt the cookie theft industry by binding authentication sessions to devices, reducing the success rate of cookie theft malware. This new feature will be fully aligned with the phase-out of third-party cookies in Chrome, ensuring the same availability and segmentation. Google is currently piloting a DBSC prototype to safeguard Google Account users, and there is significant interest in DBSC from server providers, identity providers, and other browsers.
DBSC is designed to enhance user security by using cryptographic keys to bind browser authentication sessions to a user’s device. This makes it significantly more challenging for hackers to steal cookies and gain unauthorized access to user accounts. By leveraging the Trusted Platform Module (TPM) crypto processors for secure storage, DBSC ensures that cookies are stored securely on the device.
One of the key advantages of DBSC is that it allows for the usage of short-lived cookies. This not only boosts security but also improves the detection and cleanup efficiency of malware on devices. Additionally, DBSC provides anti-tracking protections, further enhancing user privacy and protection.
In addition to DBSC, Google recommends using Enhanced Safe Browsing in Chrome to safeguard against phishing attempts and malware downloads. This feature provides an additional layer of protection to mitigate potential threats.
Overall, the introduction of Device Bound Session Credentials (DBSC) marks a significant step in combating cookie theft and enhancing user security. With its ability to bind authentication sessions to devices and its focus on disrupting the cookie theft industry, DBSC will play a crucial role in safeguarding user accounts and ensuring a safer browsing experience.

Collections

Google Chrome introduces Device Bound Session Credentials (DBSC) to enhance user security by binding authentication sessions to devices, preventing cookie theft. DBSC utilizes short-lived cookies, secure storage through TPM, and provides anti-tracking protections.

Introducing Device Bound Session Credentials: A New Defense Against Cookie Theft