Google Chrome Introduces Device-Bound Session Credentials to Enhance Account Security

Google has introduced a new feature in its Chrome browser aimed at preventing account takeovers, particularly in light of the increasing use of two-factor authentication and passkeys. This feature, called device-bound session credentials (DBSCs), stores a unique encryption key within a secure hardware component on the device running the browser. On Windows, this component is referred to as a Trusted Platform Module (TPM), while on macOS and iOS, it is known as a secure enclave. The latest versions of Chrome for Windows and macOS generate this key for enhanced security. DBSCs are designed to protect against session cookie theft, which can compromise user authentication by storing unique identifiers on browsers to facilitate quicker access to authenticated sites.