Device-bound session credentials (DBSCs) are an antidote to session cookie theft. Once a website sets a session cookie, the visiting browser must send a form of the cookie that’s signed with the key stored in the silicon. Properties in the TPM or secure enclave isolate the key in a way that prevents it from being extracted.\n\n“The attacker can’t steal the private key from the device because the TPM / Secure Enclave will not release it.

That is the core protection here,” Scott Helme, a researcher and founder of Report URI, told Ars. “The attacker can steal the cookie, but they can’t answer a DBSC challenge by signing it with the private key, which is still safe on your device.”\n\nFor the moment, DBSCs are supported only in Chrome version 147 for Windows and 150 for mac OS. Even then, DBSCs are turned on only for a limited set of users. Chrome users on Windows and mac OS can check whether it’s running by opening developer tools and scrolling down.

It’s unclear when other Chromium-based browsers will implement DBSCs, but it’s likely they will be coming.\n\nDBSCs are the latest form of authentication that eliminates reliance on a shared secret. Under this new model, web servers store the visitor’s public key. Servers then send an authentication challenge incorporating the session cookie.

Unless the resulting assertion is signed by the private key stored safely in the TPM or secure enclave, it is rejected. Passkeys work the same way.