Security

633 readers

2 users here now

A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.

Rules :

All instance-wide rules apply.
Keep it totally legal.
Remember the human, be civil.
Be helpful, don't be rude.

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

founded 1 year ago

MODERATORS

LinearArray@programming.dev

Chromium developing device bound session tokens to combat session token theft techniques (blog.chromium.org)

submitted 7 months ago by testeronious@lemmy.world to c/security@programming.dev

4 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] onlinepersona@programming.dev 0 points 7 months ago

The article specifically talks about malware running on the host machine. If that is happening, how is a TPM supposed to help?

When the browser starts a new session, it creates a new public/private key pair locally on the device, and uses the operating system to safely store the private key in a way that makes it hard to export

Great, the browser generates a key pair and puts the private key in the TPM. So the malware sits between the browser and the TPM. How is that better? Even if the private key were generated on the TPM, what stops malware from impersonating chrome or hooking into chrome?

I can't help but think it's security theatre to add another tracking mechanism behind the scenes.

Anti Commercial-AI license