Chrome adds new protection against account takeovers

Google has rolled out a new security feature in its Chrome browser aimed at significantly bolstering protection against account takeovers. The feature, known as device-bound session credentials (DBSC), seeks to defend users against a growing threat where attackers steal session cookies to gain unauthorized access to accounts.

DBSC stores a unique encryption key within the device's built-in, silicon-resident security architecture. On Windows machines, this is known as a Trusted Platform Module (TPM), and on macOS and iOS devices, it's called a Secure Enclave. Chrome generates and stores a key within this secure hardware component.

Session cookies are strings of characters that websites store in browsers to speed up login processes and keep users authenticated. The theft of these cookies can allow unauthorized access to a user's session without requiring passwords or two-factor authentication. The new DBSC feature makes stealing these credentials considerably more difficult, as the encryption key is intrinsically tied to the device's secure hardware.

This new protection is currently available in the Windows and macOS versions of the Chrome browser. Google states this represents one of the most robust defenses against session cookie theft, a method that has become increasingly common as users adopt more complex authentication methods.