Serving tech enthusiasts for over 25 years.
TechSpot means tech analysis and advice you can trust.
The takeaway: Chrome is beginning to use hardware-backed cryptographic keys to make stolen browser cookies harder to use. The feature, called device-bound session credentials, links an authenticated web session to the device where the user signed in.
The change targets a common method of account takeover. Attackers who obtain a browser session cookie can sometimes load it into another browser and gain access to an account without entering the victim's password or completing two-factor authentication. Device-bound session credentials are designed to stop that by requiring proof that the browser still has access to a private key stored on the original device.
Chrome creates that key during the session setup process and stores it in protected hardware. On Windows, that hardware is the Trusted Platform Module, or TPM. Apple devices use the Secure Enclave. The private key is kept inside that hardware rather than exposed to the operating system or browser.
