Malte Ubl's post on X, curated on eChai

Today we are starting the rollout of Device Bound Session Credentials (DBSC) for vercel.​com

DBSC makes it impossible to steal session cookies from a device. So, if you install info-stealer malware (e.g. through a supply chain attack), that malware can not steal your vercel.​com session.

Malware can still do bad things while residing on the device. But the abuse we are seeing in practice separates the stealing from the eventual abuse, and DBSC effectively prevents this.

DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie. The private key can never be retrieved ever again. Not by us, not by you, not by the malware.

Every website should use DBSC but given how new of a technology it is, we still need to build more experience in rolling it out. In our case there were lots of special cases for things like oauth apps that we needed to resolve. This is also why we are taking a slow approach to the rollout.

DBSC is currently only supported by Chrome on Mac and Windows. We are also working on a kind of polyfill for other browsers. However, the polyfill is less secure and we would love to see broader browser adoption.

There is a related technology called DPoP which is essentially the same but for apps that run on your device. We're in the process of shipping this for Vercel CLI. Ideally, all CLIs and apps would adopt this technology. Luckily rolling out DPoP is much easier than DBSC and it does not depend on browser vendor support.