來源ZDNet AI•較早收集於 2m
Chrome 新增防範瀏覽器 Cookie 竊取保護機制
💡了解 Chrome 的新安全更新如何影響基於會話的驗證，並防止帳戶被劫持。
⚡ 30 秒速覽
有什麼變化
新的安全層可防止攻擊者在不同裝置上使用竊取的 Cookie。
為什麼重要
此更新大幅提高了依賴會話令牌竊取的攻擊者的門檻。它迫使網路犯罪分子必須尋找繞過驗證的新方法，而不僅僅是簡單的 Cookie 外洩。
下一步行動
審查您應用程式的會話管理政策，確保透過實施短效令牌和 IP 綁定（若可能）來輔助瀏覽器級別的安全性。
誰應關注：Developers & AI Engineers
關鍵要點
- •新的安全層可防止攻擊者在不同裝置上使用竊取的 Cookie。
- •解決了會話劫持和未經授權存取帳戶日益嚴重的威脅。
- •強化了針對敏感使用者驗證數據的瀏覽器級別保護。
🧠 深度解析
背景與延伸：來自公開資料，非原文內容。引用 22 個來源。
🔑 增強重點摘要
- •Google Chrome's new protection, Device Bound Session Credentials (DBSC), leverages hardware-backed security modules like Trusted Platform Module (TPM) on Windows and Secure Enclave on macOS to generate and store unique, non-exportable public/private key pairs.
- •The DBSC system ensures that the issuance of new, short-lived session cookies is dependent on Chrome proving possession of the corresponding private key to the server, rendering any exfiltrated cookies useless as they quickly expire without the associated key.
- •This feature fundamentally shifts the approach to session theft mitigation from reactive detection, which relies on identifying stolen credentials after the fact, to proactive prevention by making stolen cookies unusable for attackers.
- •DBSC is designed with user privacy in mind, ensuring that each session is backed by a distinct key to prevent websites from correlating user activity across different sessions or sites on the same device, and it avoids leaking device identifiers beyond the per-session public key.
- •The implementation of DBSC directly addresses the growing threat posed by sophisticated infostealer malware families, such as LummaC2, which have become highly effective at harvesting long-lived session cookies to bypass multi-factor authentication (MFA) and gain unauthorized account access.
📊 競品分析▸ Show
| Browser | Feature | Primary Focus | Technical Approach |
|---|---|---|---|
| Google Chrome | Device Bound Session Credentials (DBSC) | Preventing session hijacking and unauthorized account access from stolen cookies | Cryptographically binds session cookies to device hardware (TPM/Secure Enclave) using non-exportable keys; short-lived cookies refreshed with proof of private key possession. |
| Mozilla Firefox | Total Cookie Protection (TCP) / Enhanced Tracking Protection (ETP) | User privacy and preventing cross-site tracking | Isolates cookies into 'cookie jars' for each website, preventing third-party cookies from tracking users across different sites. Blocks third-party cookies by default. |
| Microsoft Edge | Tracking Prevention | User privacy and controlling tracking | Offers 'Basic,' 'Balanced,' and 'Strict' modes to block third-party cookies and trackers, with 'Balanced' blocking trackers from unvisited sites and 'Strict' blocking most trackers. |
| Apple Safari | Intelligent Tracking Prevention (ITP) | User privacy and preventing cross-site tracking | Blocks third-party cookies by default, removes user-identifiable information from cross-site requests, and deletes script-writable storage if a user hasn't visited a site for seven days. |
🛠️ 技術深入
- DBSC introduces a cryptographic key pair associated with the user's device, where Chrome generates this pair during login.
- The private key is stored in secure hardware, such as a Trusted Platform Module (TPM) on Windows or Secure Enclave on macOS, making it non-exportable from the device.
- Session cookies are designed to be short-lived; when they expire, Chrome must prove possession of the private key to the server before refreshing them, thereby linking session continuity to the original device.
- Unlike previous 'Token Binding' efforts that operated at the TLS layer and faced implementation challenges, DBSC functions at the HTTP application layer, allowing for transparent integration with existing web infrastructure.
- For web applications to integrate DBSC, they need to modify their login flow to include a
Secure-Session-Registrationheader and establish a session registration endpoint to associate a public key with the user's session. - The browser manages the complex cryptographic operations and cookie rotation in the background, allowing web applications to continue using standard cookies without significant changes to their front-end.
- In scenarios where secure key storage hardware is not available on a user's device, DBSC is designed to gracefully fall back to standard session handling without disrupting the authentication flow.
🔮 前景展望基於引用來源的 AI 分析
Increased adoption of hardware-backed security for web authentication will become a new industry standard.
Chrome's DBSC leverages TPM/Secure Enclave, setting a precedent for more widespread use of secure hardware in mainstream browser security, potentially pushing other browsers or web standards towards similar implementations.
The effectiveness of infostealer malware for session hijacking will significantly decrease.
By binding session cookies to specific devices via non-exportable keys, DBSC significantly diminishes the value of stolen cookies, forcing attackers to find new exploitation vectors.
New web standards or APIs for device attestation will emerge.
The success of DBSC could lead to further standardization efforts for device-bound credentials or attestation mechanisms, allowing web services to build more robust, device-aware security policies.
⏳ 時間線
2014-07
Google Project Zero announced, tasked with finding zero-day vulnerabilities.
2018-08
Token Binding, a precursor concept to cryptographically bind security tokens, was debated, with Chrome eventually removing support for it in version 70 due to complexity.
2020-03
Apple Safari fully blocks third-party cookies by default with Intelligent Tracking Prevention (ITP) enhancements.
2024-07
Chrome 127 introduces Application-Bound Encryption on Windows, improving cookie protection beyond DPAPI by tying data to app identity.
2025-10
Firefox's Total Cookie Protection rolled out as a default setting for all users.
2026-04
Google announces Device Bound Session Credentials (DBSC) and ships it in General Availability for Windows users on Chrome 146, with a broader rollout to all users in May 2026.
📎 來源 (22)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
📰
AI 週報
閱讀本週精選 AI 大事摘要 →
👉相關動態
AI 策展新聞聚合。所有內容版權歸原始發布者所有。
原始來源： ZDNet AI ↗
每週電子報
每週一封，可隨時退訂。