Hi all, I wanted to raise Device Bound Session Credentials (DBSC) as something worth keeping on our radar, and to ask whether anyone is already looking into it.
For those unfamiliar: DBSC is a W3C WebAppSec / WICG proposal (spec at w3c/webappsec-dbsc on GitHub) that binds web session cookies to a hardware-backed private key on the client device, rather than relying on a bearer token alone. The goal is to blunt session/cookie-theft attacks — even malware with full access to the browser's cookie jar can't replay a stolen session from another machine, since the browser has to periodically prove possession of a device-bound key (TPM on Windows, Secure Enclave on macOS, etc.) to keep the session alive. Chrome has already moved this from origin trial to GA on Windows, and there's a growing ecosystem around it (e.g. early server-side integrations like the Spomky-Labs DBSC bundle for Symfony). Given the trajectory, I think it's plausible that DBSC support becomes relevant to us on a few fronts: - Browser packaging (Chromium/Firefox) and how key storage integrates with Linux TPM/keyring infrastructure - Server-side libraries and frameworks in the archive that may want to add DBSC support (auth stacks, reverse proxies, etc.) - Documentation/guidance for maintainers of security-sensitive packages The spec is still evolving — there are newer extensions like DBSC(E) for enterprise and a cross-origin SSO variant — so nothing here is urgent, but it seemed worth flagging early rather than reacting after the fact. Is anyone already tracking this, either on debian-security or elsewhere? Happy to help monitor the spec or work on packaging/integration pieces if there's interest. Thanks, Michael
