Chrome's device-bound session credentials take aim at a growing account-takeover gap
As two-factor authentication and passkey adoption have tightened the login gate across the web, attackers have pivoted to session cookies, the tokens that prove a user already authenticated without requiring a fresh credential…
Key takeaways
- Chrome has introduced device-bound session credentials (DBSCs), which anchor session tokens to a device's built-in security hardware instead of to a copyable browser profile.
- Chrome generates a unique per-device encryption key and stores it in hardware that software cannot read or export, so a session cookie stolen from one machine cannot authenticate a session on another.
- DBSCs target session-cookie theft, an attack that lets someone impersonate an authenticated user without knowing the password or one-time code because it operates after two-factor authentication and passkeys have already cleared the user.
- Recently released versions of Chrome for Windows and macOS already generate and store device-bound keys using those platforms' security chips.
- The feature addresses a class of account takeover that has grown more common as stronger front-door authentication pushes attackers toward the session layer.
As two-factor authentication and passkey adoption have tightened the login gate across the web, attackers have pivoted to session cookies, the tokens that prove a user already authenticated without requiring a fresh credential exchange. Google's Chrome browser has now introduced a feature called device-bound session credentials, or DBSCs, that responds to this shift by anchoring session tokens to the security hardware built into the device rather than to a browser profile that can be replicated or transported.
How DBSCs work
Chrome generates a unique encryption key and stores it in the device's dedicated security hardware, a location software cannot read or export from. On Windows machines that hardware carries the name Trusted Platform Module, or TPM. Apple platforms call theirs a secure enclave. Other platforms have their own names for similar architecture. The key is unique per device and generated by Chrome itself, which means a session cookie stolen from one machine cannot authenticate a session on any other.
The exploit these credentials close
Session cookies are designed to reduce friction. After a successful login, the server sets a cookie that the browser presents on subsequent requests, removing the need to re-enter credentials with each new page. That design is also the attack surface. An attacker holding a valid session cookie can impersonate an authenticated user without ever knowing the underlying password or one-time code. The method sidesteps two-factor authentication and passkeys because it operates after those protections have already cleared the user.
What Chrome is shipping
Recently released versions of Chrome for Windows and macOS already generate and store device-bound keys using the security chips those platforms provide. The feature targets a class of account takeover that has grown more common against the backdrop of improving front-door authentication, as hardening the credential layer has pushed the more viable attack path toward the session layer. Chrome's DBSCs attempt to close that path at the hardware level.
Source · 來源