Chromium developing device bound session tokens to combat session token theft techniques

3 years ago by testeronious to c/security

Cookies – small files created by sites you visit – are fundamental to the modern web. They make your online experience easier by saving bro...

onlinepersona 1 point 3 years ago

Sounds like a tracking nightmare, right off the bat. There is absolutely no way this will not be used for tracking.

Each session is backed by a unique key and DBSC does not enable sites to correlate keys from different sessions on the same device, to ensure there's no persistent user tracking added. The user can delete the created keys at any time by deleting site data in Chrome settings. The out-of-band refresh of short-term cookies is only performed if a user is actively using the session (e.g. browsing the website).

DBSC doesn’t leak any meaningful information about the device beyond the fact that the browser thinks it can offer some type of secure storage. The only information sent to the server is the per-session public key which the server uses to certify proof of key possession later.

All nice and dandy, but what constitutes a session? If you want people to stay logged in after killing the browser, that has to be stored somewhere.

I have absolutely no faith in this. And if there's malware that has the same rights as the browser, how will the TPM help? This is a serious question. How will the TPM help?

Anti Commercial-AI license

save

path: 0 9398472, hotness: undefined, score: 1, children: 3

Tramort 1 point 2 years ago

You are smart to be skeptical of Google's intentions, but it seems like it is possible to make an implementation without the problems you identified.

save

path: 0 9398472 9430470, hotness: undefined, score: 1, children: 0

JakenVeina 1 point 2 years ago

The TPM stores the private key and doesn't hand it out to anyone, not even the browser. Malware can no longer "exfiltrate" the whole session. I.E. if a piece of malware manages to compromise a cookie, it can send it off-device, where it can be freely used to impersonate the user. With the TPM involved, any impersonation of the user has to be done locally on the same device, which is theoretically more difficult to do than just silently steal a cookie.

I'm on board with you, though, in being skeptical here.

save

path: 0 9398472 9447730, hotness: undefined, score: 1, children: 1

onlinepersona 0 points 2 years ago

The article specifically talks about malware running on the host machine. If that is happening, how is a TPM supposed to help?

When the browser starts a new session, it creates a new public/private key pair locally on the device, and uses the operating system to safely store the private key in a way that makes it hard to export

Great, the browser generates a key pair and puts the private key in the TPM. So the malware sits between the browser and the TPM. How is that better? Even if the private key were generated on the TPM, what stops malware from impersonating chrome or hooking into chrome?

I can't help but think it's security theatre to add another tracking mechanism behind the scenes.

Anti Commercial-AI license

save

path: 0 9398472 9447730 9453510, hotness: undefined, score: 0, children: 0