Google plans to combat cookie theft with project DBSC

Google seems concerned regarding authentication cookies becoming easier targets by hackers. Authentication cookies which enable users to remain signed in across devices without entering passwords repeatedly are prone to theft and misuse. To this end, Google has launched an open-source project that seeks to combat cookie theft and bolster browser security for users.

Device Bound Session Credentials (DBSC) is Google’s solution to cookie theft

Authentication cookies, if stolen, can allow login to unauthorized devices, hence making them a lucrative possession for hackers. To combat this situation, Google is developing the Device Bound Session Credentials (DBSC) API which will bind authentication cookies via a device-based mechanism. This establishes a unique relationship between the website and browser thereby preventing the use of stolen cookies on different machines.

The proposed DBSC API wants to create a web standard that enhances security but at the same time respects user privacy. As a result, sites cannot use these technologies to track logins across multiple devices. Google also alludes that only minimal information such as per-session public key sent over the network maintains privacy and security for users on their side.

However, the solution may cause inconvenience when it comes to device and operating system compatibility. The idea is that around half of currently active Chrome installations on desktops will get the DBSC API from Google. However, the company will still put efforts into ensuring compatibility with older computers and software-based solutions as well.

DBSC is currently in Beta, reaching a limited number of users for testing

A prototype of the DBSC API has reached a limited number of Google Account users on Chrome Beta for testing purposes by Google. According to company sources, Okta and Microsoft Edge have all expressed their interest in the tool, hence they will also have access to it soon.

By joining hands with industry partners, Google wants it to be universally adopted as a web standard before 2024 ends thus enhancing account security amid the changing digital environment. Protecting user accounts from unauthorized access needs secure authentication cookies and two-factor authentication to become more common.