Google has launched Device Bound Session Credentials (DBSC) in open beta to fight session cookie theft. DBSC ties login sessions to a user’s device, blocking hackers from using stolen cookies on other devices.
First prototyped in April 2024, this feature strengthens account protection by preventing unauthorized remote access.
Andy Wen, Senior Director of product management at Google Workspace, said,
“Available in the Chrome browser on Windows, DBSC strengthens security after you are logged in and helps bind a session cookie – small files used by websites to remember user information – to the device a user authenticated from.”
DBSC isn’t just about securing accounts after login—it significantly raises the barrier for attackers trying to reuse session cookies and enhances overall session integrity.
Google has rolled out passkey support to over 11 million Workspace users, adding admin tools for auditing and restricting to physical keys. It also plans to launch a Shared Signals Framework (SSF) receiver in closed beta, enabling near real-time security signal exchange via the OpenID standard.
“This framework acts as a robust system for ‘transmitters’ to promptly inform ‘receivers’ about significant events, facilitating a coordinated response to security threats,”
Wen said.
“Beyond threat detection and response, signal sharing also allows for the general sharing of different properties, such as device or user information, further enhancing the overall security posture and collaborative defense mechanisms.”