Infostealer malware doesn't need your password if it can steal your authentication cookie from disk or memory, and replay it on another machine. Any webserver happily accepts the stolen cookie since it was issued by the webserver itself. This type of attack bypasses WebAuthn or MFA entirely, since the cookie gets stolen *after* you have authenticated. Since there's no real fix against this, we can only issue cookies with a shorter lifetime to minimize the attack window. Until now.

Device Bound Session Credentials (DBSC) is a W3C draft introducing a solution, by tying the session cookie to the browser or device. The browser generates a private/public key pair, storing the private key ideally in secure storage like a TPM, while the webserver only issues short-lived authentication cookies. When the cookie expires, the browser can then only refresh the cookie by signing a server-issued challenge using that private device-specific key. While this doesn't prevent cookie and session theft, it does minimize the risk since cookies go stale faster and cannot be renewed without the device's private key.

During this session, I'll demonstrate how DBSC architecturally works, including an example implementation in ASP.NET Core with .NET 11 using the experimental Microsoft.AspNetCore.Authentication.DeviceBoundSessions NuGet package. And to prove it works, I'll perform a live attack: after stealing a valid session cookie, we'll see exactly when the stolen cookie stops working because the refresh operation can't be signed.