Device-Bound Session Credentials Explained | Identity Expert

This video explains Device-Bound Session Credentials (DBSC), a browser proposal aimed at stopping stolen session-cookie replay after login. Passkeys harden the sign-in ceremony, but once an application issues a bearer cookie, that cookie can still be copied to another machine unless the server has some extra way to tell whether the original browser is the one renewing it. In this guide: why bearer session cookies stay portable after passkeys; how DBSC registers a per-session key and uses it only at refresh time; what the Secure-Session-Registration, Secure-Session-Response, Sec-Secure-Session-Id, and Secure-Session-Challenge headers do; and which attacks DBSC helps with versus the live-malware scenarios it does not solve. 0:00 Introduction 0:14 Passkeys stop at login, not session reuse 2:35 How DBSC starts and refreshes a session 4:53 Threat model 6:30 Sources Sources: WICG DBSC explainer, WICG DBSC(E) overview, RFC 6265, W3C WebAuthn Level 3, PrivacyCG Login Status API. #dbsc #sessionsecurity #browsersecurity #passkeys #identityexpert