Chrome rolls out new defense against account takeovers

According to Scott Helme, a researcher and founder of Report URI, the core protection lies in the fact that the private key cannot be extracted from the device. "The attacker can't steal the private key from the device because the TPM / Secure Enclave will not release it," Helme explained. "The attacker can steal the cookie, but they can’t answer a DBSC challenge by signing it with the private key, which is still safe on your device."

Currently, DBSCs are supported in Chrome version 147 for Windows and version 150 for macOS. However, the feature is only enabled for a limited number of users, indicating that Google is in a testing phase before a wider rollout. Chrome users on Windows and macOS can verify if the protection is active by opening developer tools, navigating to the 'Application' tab, and looking for 'device bound sessions' when logged into a supporting site.

While it remains uncertain when or if other browsers based on the Chromium engine will implement DBSCs, their adoption is considered likely. DBSCs represent a new authentication model that moves away from shared secrets, which have long been a vulnerable point for attackers. In this new system, web servers store the visitor's public key and issue an authentication challenge. The resulting authentication assertion must be signed by the private key held in the device's secure hardware to be accepted, similar to how passkeys function.