Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google debuts device-bound session credentials against session hijacking

feistyduck.com

Post reply on HN
Print view View original

11–20 of 71 posts

Re: Google debuts device-bound session credentials against session hijacking

#11

Post by IlikeKitties »

odie5533 wrote: post #7
IlikeKitties wrote: post #2

[flagged]

What negative effects are you thinking DBSC will cause?

The very next step they will take is that they will only give devices session credentials that pass remote attestation, preferably to the browser level. Than you won't be able to use alternative clients or extension google doesn't deem acceptable.

Re: Google debuts device-bound session credentials against session hijacking

#13

Post by grim_io »

odie5533 wrote: post #5

I hope it catches on! Though they suggest storing the signing keys in TPM which is ideal, even storing them locally in the browser in an unextractable manner would be enough to prevent session hijacking.

One man's session hijacking is another man's unofficial third party client support.

Re: Google debuts device-bound session credentials against session hijacking

#14

Post by yalogin »

If TPM is used then the regular session cookies are also secure, just in a different way. One can use hardware based attestation to tie the session token/cookie to the device and so they cannot be stolen or forged.

DBSC will run into all the same problems on platforms that don’t support TPMs. Not sure how this is changing the landscape. It’s just another implementation of the same thing.

Re: Google debuts device-bound session credentials against session hijacking

#15

Post by stephendause »

prasadjoglekar wrote: post #3

The first sentence > HTTP cookies were never intended for session management Seems odd. IIRC that's exactly what they were meant for. State management for http which is stateless. Am I missing some history here?

I could be wrong, but I believe the author is referring to cookies being used for session authentication as opposed to general session management.

Re: Google debuts device-bound session credentials against session hijacking

#17

Post by odie5533 »

alexbilbie wrote: post #8

There’s going to be a lot of LinkedIn scrapers and tools that are going to stop working if LinkedIn adopt this - a lot of these tools work off particular session cookies you share with them

If it's your TPM, the tools should be able to be authorized for signing too.

Re: Google debuts device-bound session credentials against session hijacking

#18

Post by mirashii »

jsnell wrote: post #6
IlikeKitties wrote: post #2

[flagged]

This has no connection with reality. This is not an attestation mechanism, and can't be used as one.

I read that not as a claim that this is an attestation mechanism, but that this is another step towards that. Given that Google has previously discussed implementing the Web Integrity API, it's not so large a leap as to be dismissed as disconnected from reality.

Re: Google debuts device-bound session credentials against session hijacking

#19

Post by jawns »

We're still in the infancy of agentic AI, but I imagine that in the next few years, it's going to be more important to be able to grant an agent your credentials to perform operations on your behalf. Basically, you want the agent to be able to do all the same things you can do. But perhaps the agent doesn't live on your local device. I'm not saying that DBSC isn't beneficial, but I think we also need to be thinking of ways to grant AI agents permissions that used to be solely tied to the user's session.
Post reply on HN