Google’s Chrome browser has added a new feature that could go a long way in preventing a form of account takeover that’s grown increasingly common as users adopt two-factor authentication, passkeys, and similar protections.
The new Chrome protection is known as device-bound session credentials (DBSCs). The measure stores a unique encryption key in a silicon-resident fortress that’s built into the device running the browser. On Windows machines, this fortress is called a TPM, short for Trusted Platform Module. On macOS and iOS, it’s known as a secure enclave. Other platforms have differing names. Recently released versions of Chrome for Windows and macOS generate a key that’s stored in this fortress.
An antidote to session cookie theft
DBSCs protect against the theft of session cookies, the unique strings of characters that websites store on browsers. Session cookies greatly speed up browsing on sensitive sites that require user authentication. Instead of requiring the exchange of credentials each time a user opens a new site page, the server sets a session cookie that effectively proves the user has already successfully logged in.
The threat of session cookie theft has grown as 2FA, passkeys and similar protections have become more common. These newer protections require additional factors beyond a shared secret before a user gets access to a restricted site. Once possession of a mere password is no longer sufficient, phishing and other more traditional forms of account takeovers are no longer effective.
To compensate, attackers have increasingly relied on infostealer malware and adversary-in-the–middle attacks. Both forms of attack work by stealing session cookies. Attackers then paste the cookies into their own browser and gain the same access the rightful owner has (at least temporarily).