FX.co ★ Google's New Feature Will Block Hackers From Stealing Cookies

Google, a subsidiary of Alphabet Inc., is developing a security feature known as Device Bound Session Credentials (DBSC) to combat the widespread issue of hackers stealing cookies—a common tool web browsers use to save user preferences and browsing data—in order to gain unauthorised access to accounts.

The convenience of cookies, which enables users to stay logged in on websites and eliminate the need for repeated sign-in procedures, unfortunately makes them an appealing target for malicious cyber actors. Hackers typically use malware to infiltrate these cookies, aiming to extract valuable authentication details.

DBSC, however, aims to effectively nullify this potential security threat. With the use of a Trusted Platform Module, or TPM chip, Google's cutting-edge feature will encrypt the authentication cookies and bind them to the user's device.

According to Kristian Monsen, a software engineer involved with Google's Chrome Counter Abuse team, by tethering the authentication sessions to individual devices, DBSC can render stolen cookies worthless. This, in turn, can result in a significant decrease in instances of successful cookie theft through malware. Attackers would be compelled to operate directly on a device, making it easier for anti-virus software or enterprise-managed devices to detect and deal with the threat.

At present, the DBSC feature is still in the prototype stage. It operates by allowing a server to initiate a new session in a browser, connecting it to a public key saved within the device via an Application Programming Interface (API). Each session is affiliated with a unique key, preventing websites from monitoring user activity across different sessions.

Monsen clarified that once DBSC is fully deployed, enhanced security for Google accounts will be automatically applied for both individual and corporate consumers. Furthermore, this feature is also being developed for Google Workspace and Google Cloud customers, as an additional layer of account security. Initially, it's worth noting that this feature will only support half of all Chrome desktop devices.