All articles tagged with #device bound session credentials
Google is rolling out Device Bound Session Credentials (DBSC) in Chrome for Windows, binding a login session to the device used to sign in to prevent stolen cookies from being exploited. The rollout, which started May 25, is gradual and should be complete within 60 days, and the feature is enabled by default for Workspace users and personal Google accounts.
Google Chrome is proposing Device Bound Session Credentials (DBSC) to combat cookie theft malware by binding authentication sessions to the device using a public/private key pair stored locally, making it harder to export. The API allows servers to associate a session with the public key and verify proof-of-possession of the private key throughout the session lifetime. Google aims to make DBSC an open web standard and is already testing it in Chrome Beta for some Google Accounts, with plans for origin trials by the end of 2024.