Nemeski to [email protected]English • 3 months agoFighting cookie theft using device bound sessionsblog.chromium.orgexternal-linkmessage-square9fedilinkarrow-up158arrow-down12cross-posted to: security
arrow-up156arrow-down1external-linkFighting cookie theft using device bound sessionsblog.chromium.orgNemeski to [email protected]English • 3 months agomessage-square9fedilinkcross-posted to: security
minus-square@[email protected]linkfedilinkEnglish0•3 months agoIsn’t this what WebAuthn already does? Why introduce a new protocol when another one does the job well?
minus-square@dracslinkEnglish5•3 months agoI don’t think WebAuthn protects against cookie theft. WebAuthn better protects the login process. But if the result of the login process is still a session/auth cookie, that can be stolen like any other cookie.
Isn’t this what WebAuthn already does? Why introduce a new protocol when another one does the job well?
I don’t think WebAuthn protects against cookie theft. WebAuthn better protects the login process. But if the result of the login process is still a session/auth cookie, that can be stolen like any other cookie.