Google marks a turning point in preventing cybercrime

Google has announced the public rollout of its Device-Bound Session Credentials (DBSC) for Windows users via Chrome 146. This significant advancement in security is designed to combat session hijacking, a common technique used by attackers to compromise user accounts.

With this release, Google marks a shift towards proactive threat prevention, moving away from reactive approaches based on intrusion detection.

Fighting Against Cybersecurity!

DBSC links an authentication session to the user’s physical device through hardware-backed security modules, such as the Trusted Platform Module (TPM) on Windows devices. Upon logging in, the hardware generates a pair of public and private keys, where the private key can never be exported from the device. This measure ensures that even if an attacker steals the session cookies, they quickly become useless, as the credentials expire in a short period and the attacker lacks the physical key of the device.

In addition, the DBSC protocol will soon be implemented on macOS, expanding its reach. This technology allows web developers to integrate advanced security measures without additional complications, as Chrome handles the cryptographic complexities in the background. Despite its strict device linking capabilities, DBSC incorporates rigorous privacy controls, using a completely separate key for each session, which prevents unwanted tracking of users.

Google developed DBSC as an open standard in collaboration with W3C and Microsoft, testing it on platforms like Okta. Looking ahead, it is expected that the capabilities of DBSC will expand to secure federated identity environments and single sign-on (SSO) in enterprises, as well as advanced registration options that link sessions to existing hardware security keys.