Chromium Blog

Blog.chromium.org is the official website of the Chromium project. It provides readers with the latest updates, announcements, and insights into the world of browser technology. The site consists of various sections including the main blog, team members' profiles, project information, and resources related to Chromium development.

Thread Of Notes

Cookies, crucial for online convenience, are also vulnerable to theft, enabling attackers to access accounts. Cookie theft malware uses social engineering to infiltrate devices, exfiltrating authentication cookies that bypass two-factor authentication and anti-virus detection.To address this issue, Device Bound Session Credentials (DBSC) is being developed as a new web capability that binds authentication sessions to the device, rendering stolen cookies worthless. By forcing attackers to act locally, DBSC enhances on-device detection and cleanup.DBSC employs public/private key pairs stored securely on the device to establish sessions, verifying proof of possession throughout the session's lifetime.To maintain session freshness and support existing cookie-based solutions, DBSC uses a dedicated endpoint for out-of-band cookie refresh.DBSC prioritizes user privacy by ensuring no correlation of keys from different sessions on the same device, allowing users to delete keys at any time.The only information sent to the server is the per-session public key, which certifies proof of key possession.DBSC aligns with the phase-out of third-party cookies, disabling it in those scenarios.Google is piloting DBSC for some Google Account users, providing enhanced security.DBSC has garnered interest from server providers, identity providers, and browsers who seek to protect users from cookie theft.The development process is open and collaborative, with updates and timelines available on GitHub.
Automated certificate issuance and management enhances web security by fostering agility, resilience, and efficiency. It eliminates manual intervention, reducing errors and expediting the adoption of new security measures. Automation also increases resilience to CA incidents, internet security weaknesses, and cryptographic deprecations.The reduction in maximum certificate validity from unlimited to 398 days in recent years has strengthened security by mitigating the impact of key compromises and security flaws.Certificate automation, powered by standards like ACME, simplifies certificate management and allows for seamless protection against outages caused by certificate expiration or unforeseen events.ACME Renewal Information (ARI) enables CAs to notify web servers about impending certificate renewals, allowing for automatic replacement without human intervention.Automation reduces operational costs by freeing up IT resources, allowing them to focus on more strategic tasks.Incidents like Let's Encrypt's 2019 bug highlight the value of automation in responding swiftly to CA incidents.Automation also aids in the timely remediation of internet security weaknesses, as seen with the Heartbleed bug in 2014.Modern automation technologies like ACME and ARI reduce the burden on website operators to reissue affected certificates in response to security vulnerabilities.Shorter certificate validity periods minimize the window of opportunity for attackers, and automation facilitates the transition to reduced validity.Cryptographic deprecations, like the phasing out of SHA-1, are handled more efficiently with automation, ensuring continued security and compliance.