Google on Wednesday rolled out a security feature in Chrome 146 that fundamentally changes how login sessions work on the web. Device Bound Session Credentials, or DBSC, cryptographically ties your authentication cookies to your specific device using hardware-backed security modules. If someone steals your cookies, they are useless on any other machine. [1] [2]

The problem DBSC solves is one of the most persistent in web security. Session cookies — the small tokens that keep you logged into Gmail, your bank, or a crypto exchange — have become the primary target of infostealer malware. These programs extract cookies from a victim's browser and transmit them to an attacker, who can then impersonate the victim without ever knowing their password. The technique bypasses two-factor authentication entirely, because the stolen cookie represents an already-authenticated session. [1] [2]

DBSC defeats this by generating a public-private key pair during login and storing the private key in the device's Trusted Platform Module (TPM) — a hardware chip present in most modern Windows PCs. The server issues a short-lived cookie and associates it with the public key. At regular intervals, Chrome must prove possession of the private key to refresh the cookie. If the cookie is exfiltrated to another device, that device cannot produce the required proof, and the session dies. [2] [3]

"DBSC protects against session theft by cryptographically binding authentication sessions to a specific device," Google's security blog explained. "It does this using hardware-backed security modules, ensuring that a stolen session cookie has no value outside the device it was created on." [2]

The feature launched initially for Chrome on Windows, where TPM availability is widespread. Google said it plans to extend DBSC to other platforms as hardware support matures. The Chrome 146 rollout enables DBSC by default — no user configuration is required. [1] [3]

For the security community, the significance is in what DBSC makes obsolete. Infostealers like RedLine, Raccoon, and Vidar have built entire criminal economies around cookie theft. DBSC does not prevent the initial theft — malware can still exfiltrate cookies — but it renders the stolen data worthless, which collapses the business model.

The limitation is architectural. DBSC requires both the browser and the server to support the protocol. Google's own services will implement it first, and the company is working with other identity providers and websites to adopt the standard. Until then, DBSC protects Google accounts on Chrome but not third-party sites that haven't implemented the server side. [2]

What makes this quietly important is the shift in philosophy. For years, the security industry told users to protect their credentials. DBSC shifts the burden to the hardware itself. Your login is not your password anymore. It is your machine.

-- KENJI NAKAMURA, Tokyo