Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google debuts device-bound session credentials against session hijacking

feistyduck.com

Post reply on HN
Print view View original

41–50 of 71 posts

Re: Google debuts device-bound session credentials against session hijacking

#41

Post by antithesizer »

IlikeKitties wrote: post #9
jsnell wrote: post #6

Earlier quoted context omitted.

This has no connection with reality. This is not an attestation mechanism, and can't be used as one.

Yes it absolutely is and will be used as such, this is EXACTLY how google play remote attestation works and a necessary building block for doing it in the browser. It is the exact reason why microsoft and google are pushing for tpms in windows 11 and it's already a reality on android and every grapheneos user knows the pain[0] and is the absolutely logical next step. [0] https://grapheneos.org/articles/attestation-co…

[dead]

Re: Google debuts device-bound session credentials against session hijacking

#42

Post by aleksejs »

yalogin wrote: post #14

If TPM is used then the regular session cookies are also secure, just in a different way. One can use hardware based attestation to tie the session token/cookie to the device and so they cannot be stolen or forged. DBSC will run into all the same problems on platforms that don’t support TPMs. Not sure how this is changing the landscape. It’s just another implementation of the same thing.

I'm not sure I follow your point: how would a web service provider use a user's TPM in a pre-DBSC world? "Use hardware based attestation to tie the session token/cookie to the device" is pretty much exactly what DBSC does.

DBSC is intended to be deployed opportunistically alongside regular cookies, so users on devices without TPMs just won't benefit from the additional protections that DBSC provides.

Re: Google debuts device-bound session credentials against session hijacking

#43

Post by pessimizer »

gjsman-1000 wrote: post #33
IlikeKitties wrote: post #30

Earlier quoted context omitted.

[flagged]

> You all don't understand how any of this tech works but you think you do. We do; and it is specifically called out in the spec that the certificate chain is not submitted, due to the potential for overpowered fingerprinting. As such, this battle, should they make a move to change that, needs to be fought a different day. Fighting against hypotheticals is pointless. Edit: For the pedantic, fighting against hypotheti…

> Fighting against hypotheticals is pointless.

No, fighting against things that have already happened is pointless. We only ever fight against hypotheticals. We fight to avoid something happening that has not happened.

Re: Google debuts device-bound session credentials against session hijacking

#44

Post by throwawayffffas »

mathiaspoint wrote: post #36

Unless you're paying me a lot of money (and even then) I WILL NOT MAINTAIN AN HSM FOR YOUR SERVICE. PLEASE FUCK OFF. If you cared about security you would let me authenticate with ssh key signatures. GitHub does this, if you can manage to talk to an HSM you can manage to talk to the openssh agent.

This so much, it's all about locking people to their hardware and walled gardens.

Re: Google debuts device-bound session credentials against session hijacking

#45

Post by Vecr »

dlojudice wrote: post #27

I think the DBSC is on the right direction but while it generates separate keys per session to prevent cross-session tracking (Google's ultimate ad dream), the spec acknowledges a critical vulnerability: malicious sites can collaborate by attempting to guess public keys until they find matches, creating persistent cross-site user identifiers, essentially weaponizing the security feature into the ultimate tracking sys…

How long are the public keys? >160 bits and that's futile.

Re: Google debuts device-bound session credentials against session hijacking

#46

Post by pessimizer »

UltraSane wrote: post #23
IlikeKitties wrote: post #2

[flagged]

This inexplicable overreaction to genuinely valuable security improvements is getting ridiculous. Computer security is a complete dumpster fire right now and we need things like this.

> we need things like this.

Speak for yourself, Kemosabe.

Re: Google debuts device-bound session credentials against session hijacking

#47

Post by IlikeKitties »

tantalor wrote: post #39
IlikeKitties wrote: post #11

Earlier quoted context omitted.

The very next step they will take is that they will only give devices session credentials that pass remote attestation, preferably to the browser level. Than you won't be able to use alternative clients or extension google doesn't deem acceptable.

(engaging in good faith...) What's preventing alternative clients from doing that?

[flagged]

Re: Google debuts device-bound session credentials against session hijacking

#49

Post by jeffbee »

jsnell wrote: post #6
IlikeKitties wrote: post #2

[flagged]

This has no connection with reality. This is not an attestation mechanism, and can't be used as one.

Yes but the commenter has referred to you as a stock animal, therefore he automatically wins the debate. Sorry, I don't make the rules.

Re: Google debuts device-bound session credentials against session hijacking

#50

Post by Garvi »

This will break and fracture the web. Unfortunately many here have much to lose by criticizing google. I have just spent 8 hours today updating my apps on the google play store, answering business emails on my google email account and updating customer tracking data on google analytics and updating their google ads.

If they decide to make an example out of me, to teach the rest of you how to behave, I am screwed. I guess that's the "freedom" you US based folks are talking about. This has already been affecting the discourse on sites like HN for a while.

Post reply on HN