Google Launches Device Bound Session Credentials to Combat Session Theft

Google has officially rolled out Device Bound Session Credentials (DBSC) for Windows users of its Chrome web browser, specifically in version 146. This feature aims to address the growing issue of session theft, a cybersecurity threat where malware extracts session cookies from browsers, allowing attackers to access user accounts without needing passwords. The company plans to extend DBSC support to macOS in a future release.

Google launches cookie protection feature to combat session theft By Investing.comGoogle Rolls Out DBSC in Chrome 146 to Block Session Theft on WindowsGoogle Online Security Blog: Protecting Cookies with Device Bound Session CredentialsTo counter cookie theft, Chrome ships device-bound session credentialsChrome rolls out hardware-bound session protection to combat infostealer malware

DBSC utilizes hardware-backed security modules, such as the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS, to create a unique public/private key pair that remains securely stored on the device. When a user logs in, Chrome must prove possession of the private key to the server before new short-lived session cookies are issued. This design ensures that even if session cookies are stolen, they quickly expire and become useless to attackers, as they cannot authenticate without the private key.

To counter cookie theft, Chrome ships device-bound session credentialsChrome rolls out hardware-bound session protection to combat infostealer malwareGoogle Online Security Blog: Protecting Cookies with Device Bound Session CredentialsGoogle Rolls Out DBSC in Chrome 146 to Block Session Theft on WindowsGoogle launches cookie protection feature to combat session theft By Investing.com

Session theft is primarily facilitated by infostealer malware, which infiltrates devices and extracts authentication cookies. These cookies often have extended lifetimes, allowing attackers to reuse them for unauthorized access. Historically, mitigating session theft has been reactive, relying on detecting stolen credentials after the fact. DBSC shifts this paradigm to proactive prevention, fundamentally altering how web security can defend against such threats.

Google Online Security Blog: Protecting Cookies with Device Bound Session CredentialsChrome rolls out hardware-bound session protection to combat infostealer malwareGoogle Rolls Out DBSC in Chrome 146 to Block Session Theft on WindowsTo counter cookie theft, Chrome ships device-bound session credentialsGoogle launches cookie protection feature to combat session theft By Investing.com

Google emphasizes that DBSC is designed with user privacy in mind. Each session is backed by a distinct cryptographic key, preventing websites from correlating user activity across different sessions or sites. The protocol minimizes information exchange, only sharing the per-session public key necessary for authentication, thus avoiding cross-site tracking or device fingerprinting.

Chrome rolls out hardware-bound session protection to combat infostealer malwareTo counter cookie theft, Chrome ships device-bound session credentialsGoogle Rolls Out DBSC in Chrome 146 to Block Session Theft on WindowsGoogle launches cookie protection feature to combat session theft By Investing.comGoogle Online Security Blog: Protecting Cookies with Device Bound Session Credentials

DBSC was developed through collaboration with Microsoft and input from the W3C Web Application Security Working Group. Google conducted two Origin Trials involving major identity and security platforms, including Okta, to refine the protocol based on real-world feedback. Future enhancements will focus on federated identity systems, advanced registration capabilities, and broader device support, including software-based keys for devices lacking dedicated secure hardware.

To counter cookie theft, Chrome ships device-bound session credentialsGoogle Online Security Blog: Protecting Cookies with Device Bound Session CredentialsGoogle launches cookie protection feature to combat session theft By Investing.comChrome rolls out hardware-bound session protection to combat infostealer malwareGoogle Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows

Google stated, “This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.” The company has reported a measurable reduction in session theft incidents since the early deployment of DBSC, indicating the protocol's effectiveness.

Chrome rolls out hardware-bound session protection to combat infostealer malware

While the rollout of DBSC has been met with optimism, some cybersecurity experts express concerns about the reliance on hardware-backed security, which may not be universally available across all devices. Critics argue that this could create disparities in security levels among users.

Chrome rolls out hardware-bound session protection to combat infostealer malware

As Google continues to evolve the DBSC standard, it aims to enhance support for federated identity systems and introduce advanced capabilities tailored for enterprise environments. The ongoing development will also explore integrating existing trusted credentials, ensuring comprehensive protection against session theft across diverse ecosystems.

Google Online Security Blog: Protecting Cookies with Device Bound Session Credentials