Device Bound Session Credentials

[benjaminackerman]

Session description

Device Bound Session Credentials (DBSC) aims to enhance protection against web session theft by using a secure session that is bound to the device between the browser and web application. This session will provide a breakdown of the general attack vector of cookie theft that it is aiming to disrupt, an overview of the proposed DBSC web standard and host an open discussion about the web standard to gather any feedback or suggestions by the community. The session also covers an addition to the standard layered on DBSC, called the DBSC(E). DBSC(E) aims to provide session protection from malware for enterprise use cases against web session theft as an opt in.

Session goal

Present the DBSC and DBSC(E) API and protocol proposed for standardization and have an open discussion about any of the various components that are of interest.

Additional session chairs (Optional)

@kmonsen, @arnar, @alextok, @sameerag

Who can attend

Anyone may attend (Default)

IRC channel (Optional)

#dbsc

Other sessions where we should avoid scheduling conflicts (Optional)

#10

Instructions for meeting planners (Optional)

No response

Agenda for the meeting.

No response

Links to calendar

• 2024-09-25, 10:00 - 11:00

Meeting materials

• Dbsc breakout intro slides
• Dbsc slides
• Dbsc-e slides
• Minutes

[tpac-breakout-bot]

Thank you for proposing a session!

You may update the session description as needed and at any time before the meeting, but please keep in mind that tooling relies on issue formatting: follow the instructions and leave all headings and other formatting intact in particular. Bots and W3C meeting organizers may also update the description, to fix formatting issues or add links and other relevant information. Please do not revert these changes. Feel free to use comments to raise questions.

Do not expect formal approval; W3C meeting organizers endeavor to schedule all proposed sessions that are in scope for a breakout. Actual scheduling should take place shortly before the meeting.

[sameerag]

Adding to this session: Microsoft will co-present with Google the enterprise additions to this proposal. Current explainer is in the process of an update, and will be published before TPAC. Please check for updates in the main dbsc repo.