Google's New Feature Will Block Hackers From Stealing Cookies

(RTTNews) - Alphabet, Inc.'s (GOOG) Google is working on a new feature called Device Bound Session Credentials or DBSC to stop hackers from stealing cookies and using them to hijack accounts.

Cookies are widely used by websites to store user's browsing information and preferences to keep the user signed in, allowing them to skip log-in authentication process in the future.

However, these cookies are often targeted by hackers, who use malware to attack them and steal the authentication information.

The tech giant said that its DBSC feature will combat the cookie theft by cryptographically binding the authentication cookies to the user's device with the help of Trusted Platform Module or TPM chip.

"By binding authentication sessions to the device, DBSC aims to disrupt the cookie theft industry since exfiltrating these cookies will no longer have any value," explained Kristian Monsen, a software engineer on Google's Chrome Counter Abuse team. "We think this will substantially reduce the success rate of cookie theft malware. Attackers would be forced to act locally on the device, which makes on-device detection and cleanup more effective, both for anti-virus software as well as for enterprise managed devices."

DBSC, currently in prototype phase, allows a server to start a new session on the browser by associating it with a public key stored in the device using Application Programming Interface or API. The feature links a unique key with each session, disabling the sites to track the user's activities across different sessions.

"When it's deployed fully, consumers and enterprise users will get upgraded security for their Google accounts under the hood automatically," Monsen ensured as the feature will initially support only half of all Chrome desktop devices.

"We are also working to enable this technology for our Google Workspace and Google Cloud customers to provide another layer of account security," Monsen added.