Google has announced the public rollout of its Device-Based Session Credentials (DBSC) for Windows users through Chrome 146. This significant advancement in security is designed to combat session hijacking, a common technique used by attackers to compromise user accounts. With this release, Google marks a shift towards proactive threat prevention, moving away from reactive approaches based on intrusion detection. Fighting against cybersecurity! DBSC links an authentication session to the user’s physical device using hardware-backed security modules, such as the […]
Google has announced the public rollout of its Device-Bound Session Credentials (DBSC) for Windows users via Chrome 146. This significant advancement in security is designed to combat session hijacking, a common technique used by attackers to compromise user accounts.
With this release, Google marks a shift towards proactive threat prevention, moving away from reactive approaches based on intrusion detection.
Fighting Against Cybersecurity!
DBSC links an authentication session to the user’s physical device through hardware-backed security modules, such as the Trusted Platform Module (TPM) on Windows devices. Upon logging in, the hardware generates a pair of public and private keys, where the private key can never be exported from the device. This measure ensures that even if an attacker steals the session cookies, they quickly become useless, as the credentials expire in a short period and the attacker lacks the physical key of the device.
In addition, the DBSC protocol will soon be implemented on macOS, expanding its reach. This technology allows web developers to integrate advanced security measures without additional complications, as Chrome handles the cryptographic complexities in the background. Despite its strict device linking capabilities, DBSC incorporates rigorous privacy controls, using a completely separate key for each session, which prevents unwanted tracking of users.
Google developed DBSC as an open standard in collaboration with W3C and Microsoft, testing it on platforms like Okta. Looking ahead, it is expected that the capabilities of DBSC will expand to secure federated identity environments and single sign-on (SSO) in enterprises, as well as advanced registration options that link sessions to existing hardware security keys.
Author: Chema Carvajal Sarabia
{
"de-DE": "Journalist, spezialisiert auf Technologie, Unterhaltung und Videospiele. Über das zu schreiben, was mich begeistert (Gadgets, Spiele und Filme), ermöglicht es mir, bei Verstand zu bleiben und mit einem Lächeln im Gesicht aufzuwachen, wenn der Wecker klingelt. PS: Das stimmt nicht 100% der Zeit.",
"en-US": "Journalist specialized in technology, entertainment and video games. Writing about what I'm passionate about (gadgets, games and movies) allows me to stay sane and wake up with a smile on my face when the alarm clock goes off. PS: this is not true 100% of the time.",
"es-ES": "Content Manager - Periodista especializado en tecnología, entretenimiento y videojuegos. Escribir sobre lo que me apasiona (cacharros, juegos y cine) me permite seguir cuerdo y despertarme con una sonrisa cuando suena el despertador. PD: esto no es cierto el 100 % de las veces.",
"fr-FR": "Journaliste spécialisé dans la technologie, le divertissement et les jeux vidéo. Écrire sur ce qui me passionne (gadgets, jeux et films) me permet de rester sain d'esprit et de me réveiller avec le sourire aux lèvres quand le réveil sonne. PS : cela n'est pas vrai 100 % du temps.",
"it-IT": "Giornalista specializzato in tecnologia, intrattenimento e videogiochi. Scrivere di ciò che mi appassiona (gadget, giochi e film) mi permette di mantenere la sanità mentale e di svegliarmi con un sorriso sul viso quando suona la sveglia. PS: questo non è vero al 100% del tempo.",
"ja-JP": "",
"nl-NL": "",
"pl-PL": "",
"pt-BR": "Jornalista especializado em tecnologia, entretenimento e videogames. Escrever sobre o que me apaixona (gadgets, jogos e filmes) me permite manter a sanidade e acordar com um sorriso no rosto quando o despertador toca. PS: isso não é verdade 100% do tempo.",
"social": {
"email": "chemacs91@gmail.com",
"facebook": "",
"twitter": "https://twitter.com/chematopetazo",
"linkedin": ""
}
}
View all posts by Chema Carvajal Sarabia
