Session cookies are very useful tools because they allow a website to identify that several requests come from the same computer, keeping the user authenticated. However, this convenience carries a risk, as cybercriminals frequently try to hijack accounts by exploiting session cookies.
In response to this threat, Google introduced a safeguard in Chrome designed to prevent such malicious actions. This new feature is called Device Bound Session Credentials (DBSC), which can be freely translated as 'Device-Bound Session Credentials.'
The process begins when a user accesses a compatible website and it generates a session cookie; at that moment, the browser produces a unique pair of cryptographic keys. The private key of this pair is then stored in a security chip on the user's computer, specifically the TPM chip on Windows machines or the Secure Enclave on Macs.
This measure offers significant protection: if a hacker manages to obtain a session cookie by any means, such as through malware, and tries to use it on another computer to invade the account, access will be denied. This happens because the receiving machine for the cookie does not possess the cryptographic key generated by DBSC.
The logic behind this is that the public key of the generated pair remains on the web servers. When an access request is made to these servers, they validate the session cookie and send an authentication challenge. Only the private key, stored in the TPM or Secure Enclave, can sign the response to this challenge, preventing unauthorized access by an intruder.
Although a breach of the TPM or Secure Enclave is theoretically possible, these chips were designed to be 'attack-proof,' making the risk of capturing the cryptographic key extremely low.
It is important to note that this protection requires the use of Chrome version 146 or higher for Windows systems. For Macs, DBSC support is already available, as reported by Ars Technica. However, availability for Linux has not yet been officially confirmed, although there is an implementation of the technology in the Chromium code for this system, still in the testing phase.
Google announced a new feature that connects the Gemini Spark artificial intelligence assistant to the Chrome browser. This integration allows the AI to perform activities directly on the internet, using accounts that the user already has logged into the system.
According to the company, this feature enables the assistant to use active credentials and passwords saved in the browser to complete routine tasks, such as searching for flight options and initiating the booking process.
The rollout of this novelty began in the United States and is planned to expand to other countries later.
With its incorporation into Chrome, Gemini Spark now interacts directly with the websites the user accesses. Google assures that the AI will be able to use credentials already stored in the browser to perform certain actions without forcing the user to log in again during the procedure.
Examples cited by the company include searching for air tickets, starting flight reservations, and scheduling property viewings. However, Google has not specified any other functions the assistant may perform so far.
Considering that Gemini Spark will have access to connected accounts and passwords stored in Chrome, Google emphasized the implementation of robust security mechanisms to prevent any misuse. The platform was designed to resist attacks known as prompt injection.
In these attacks, commands disguised in user-generated content or malicious websites attempt to manipulate the artificial intelligence into performing unintended actions. Such intrusions could, for example, lead the AI to initiate financial transactions or leak confidential user data. However, Google chose not to disclose technical details about these safeguards.
The company communicated that it is adopting a multi-layered defense approach, combining deterministic and probabilistic methods to make executing this type of attack difficult and costly. Even with access to the browser, Gemini Spark does not have the autonomy to finalize payments. Google clarified that whenever a purchase needs to be completed, the task will be returned to the user for their review and approval before the transaction is finalized.
The new feature was initially launched in the United States. Additionally, Google extended the availability of Gemini Spark to Google AI Pro plan subscribers in over 160 nations. The assistant also offers integration with Google Workspace applications.
