Chrome adopts what may be the best protection yet against account takeovers
Chrome adopts device-bound session credentials that tie login sessions to a specific device, defending against cookie-theft account takeover attacks.
Chrome is adopting device-bound session credentials, which bind authenticated sessions to the physical device rather than to transferable cookies. The mechanism targets a common account takeover technique in which attackers steal session cookies and replay them on other machines. Ars Technica characterizes it as possibly the strongest protection yet against this class of takeover, which has become increasingly common.
- Sessions become device-bound instead of cookie-portable
- Targets cookie-theft-based account takeover
- Could blunt infostealer-driven session hijacking
- Vendors
- Products
- Chrome
- Organizations
- Ars Technica
From the original article
Device-bound session credentials thwart an increasingly common form of account takeover.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.