NewsHK
As two-factor authentication and passkey adoption have tightened the login gate across the web, attackers have pivoted to session cookies, the tokens that prove a user already authenticated without requiring a fresh credential exchange.
Google's Chrome browser has now introduced a feature called device-bound session credentials, or DBSCs, that responds to this shift by anchoring session tokens to the security hardware built into the device rather than to a browser profile that can be replicated or transported.
How DBSCs work Chrome generates a unique encryption key and stores it in the device's dedicated security hardware, a location software cannot read or export from.
On Windows machines that hardware carries the name Trusted Platform Module, or TPM. Apple platforms call theirs a secure enclave. Other platforms have their own names for similar architecture.
Keep reading