tech
Chrome adopts what may be the best protection yet against account takeovers
Device-bound session credentials thwart an increasingly common form of account takeover.
TL;DR
- Chrome's new feature, device-bound session credentials (DBSCs), aims to prevent account takeovers.
- DBSCs store encryption keys in secure hardware like TPMs on Windows or secure enclaves on macOS/iOS.
- The feature protects against session cookie theft, a common attack vector for account takeovers.
- Attackers previously relied on stealing session cookies after traditional methods were thwarted by two-factor authentication and passkeys.
- DBSCs require a signature from the private key stored in secure hardware, which cannot be extracted by attackers.
- The feature is currently available in limited releases of Chrome for Windows and macOS.