Device Bound Session Credentials lands in Chrome on macOS

Device Bound Session Credentials (DBSC) — Chrome's mechanism for binding sessions to hardware-backed private keys to defeat cookie theft — has arrived on macOS in Chrome 147, backed by the Secure Enclave (Windows support launched in Chrome 145 via TPM). The rollout is gradual via Chrome's Finch variations system, meaning many users are in a control arm with the underlying key service disabled. The post explains how to read your variations assignment via chrome://version/?show-variations-cmd, decode the hashed trial/group pairs, and force-enable DBSC for local testing using specific --enable-features flags. Critically, even enabling the top-level DeviceBoundSessions flag won't work if UseUnexportableKeyServiceInBrowserProcess is off — which is the case for control group users. For site operators, DBSC degrades gracefully: browsers without support simply ignore the registration header and fall back to normal cookie sessions.

Source: https://scotthelme.co.uk/device-bound-session-credentials-lands-in-chrome-on-macos. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.