Vercel Begins Rollout of Device Bound Session Credentials (DBSC)

Vercel has begun rolling out Device Bound Session Credentials (DBSC) for vercel.com to prevent session cookie theft by malware. DBSC stores a non-retrievable private key in the device's TPM to sign cookies, effectively neutralizing cookie-stealing info-stealer malware. The technology is currently supported by Chrome on Mac and Windows, and Vercel is also implementing a related technology, DPoP, for the Vercel CLI. Open article →