Chrome is locking session cookies to your hardware

Stealing your session cookies might soon be useless to hackers.

Google is testing a feature called Device Bound Session Credentials (DBSCs) in Chrome, Ars Technica reports. It ties authentication cookies directly to your computer's security hardware, like a Windows TPM or Apple Secure Enclave. When a site issues a challenge, your browser signs it using a private key trapped inside the chip that attackers cannot extract.

Why it matters: Session theft is a cheap way for attackers to hijack accounts without needing your password. DBSCs fix this by eliminating shared secrets. A hacker can still steal your cookie, but without your physical device to sign the server's challenge, the login attempt fails.

DBSCs are currently testing on a limited rollout in Chrome version 147 for Windows and 150 for macOS. To check if it is active for you, open Developer Tools, click the Application tab, and scroll down to look for "device bound sessions."

Shared secrets are finally dying out, one hardware chip at a time.