Vercel is gradually rolling out Device Bound Session Credentials (DBSC) for logins at vercel.com, BleepingComputer reports.
- Your session gets tied to a private key in your device’s TPM, which signs the cookie. CTO Malte Ubl: the key “can never be retrieved ever again. Not by us, not by you, not by the malware”
- A stolen cookie won’t work on another machine, which kills a big infostealer trick
- It works in Chrome on macOS and Windows for now. A similar protection, DPoP, is coming to the Vercel CLI
- Vercel also launched Security Review (public beta) for Pro and Enterprise, which scans each push for issues like missing auth checks and exposed secrets
My take
This is exactly what we need with session-cookie theft everywhere right now. I’d love to see every admin console do this.
God Bless, and May the Source Be with You!
