Apr 18th 2025 by Benito Gonzalez
AI-created, human-edited.
In a recent episode of Security Now, hosts Steve Gibson and Leo Laporte discussed an important new web technology that could fundamentally change how we authenticate online: Device-Bound Session Credentials (DBSC). This security innovation promises to make web sessions more secure by binding authentication to your physical device rather than relying solely on traditional cookies.
As Gibson explained, the entire model of the web began as stateless—Sir Timothy Berners-Lee's original World Wide Web was simply "a mass of pages containing links to other pages" with no concept of logging in or maintaining session state. This changed in 1994 when Netscape engineer Lou Montulli developed the concept of browser cookies to retain transaction data.
Traditional cookies, while revolutionary, have significant security limitations. They function as "bearer tokens"—if someone steals your cookie, they can impersonate you online. Despite improvements like HTTPS encryption and secure flags, cookies remain vulnerable to various attacks, including theft and session hijacking.
DBSC represents a major security upgrade by creating a cryptographic binding between your device and web sessions. Here's how it works:
When you authenticate to a website with DBSC, your device's public key is sent to the serverThe website provides short-lived session cookies (unlike today's potentially long-lived cookies)As cookies approach expiration, the browser connects to a special authentication endpointThis endpoint sends a cryptographic challenge that your device must sign using its private keySince the private key never leaves your device's hardware (often stored in the TPM), this proves you're using the original deviceUpon successful verification, fresh short-lived cookies are issuedAs Gibson summarized: "Only that one device in the galaxy could [sign the challenge]," making this an extremely secure form of authentication.
DBSC offers several significant advantages:
Better security: Makes session hijacking far more difficultPrivacy protection: Each session uses separate keys that can't be linked to identify the same deviceEase of implementation: Most of the website doesn't need to change; it still sees regular session cookiesReduced friction: Could potentially reduce the need for frequent multi-factor authenticationSeamless experience: Authentication happens invisibly to the userLeo Laporte noted this could potentially reduce the need for annoying CAPTCHAs and frequent multi-factor authentication requirements when using the same trusted device.
According to Gibson, DBSC has already been implemented in all three major browser engines:
SafariFirefoxChrome (added in version 135)This means it's also available in Chromium-based browsers like Edge and Brave.
However, widespread adoption requires websites to implement DBSC on their end. Gibson suggested financial institutions, domain registrars, and other security-sensitive services would likely be early adopters.
Device-Bound Session Credentials represent a careful compromise between security and practicality. Previous attempts to replace cookies failed because they were "unwilling to make a compromise," as Gibson noted. DBSC takes a pragmatic approach, using hardware-backed cryptography for periodic verification while still using cookies for moment-to-moment interactions.
As TPM availability continues to grow (currently at about 60% of Windows users), we can expect DBSC to become increasingly important in securing our online activities.
Share: Copied! Security Now #1021Apr 15 2025 - Device Bound Session Credentials
Hotpatching in Win 11, Apple vs. U… All Tech posts Contact Advertise CC License Privacy Policy Ad Choices TOS Store Twitter Facebook Instgram YouTube Yes, like every site on the Internet, this site uses cookies. So now you know. Learn more Hide Home Schedule Subscribe Club TWiT About Club TWiT FAQ Access Account Members-Only Podcasts Update Payment Method Connect to Discord TWiT Blog Recent Posts Advertise Sponsors Store People About What is TWiT.tv Tickets Developer Program and API Tip jar Partners Contact Us