What happened
Analysis and impact
账户接管（Account Takeover，ATO）通常指攻击者通过钓鱼、恶意软件或数据泄露等方式获取用户的登录会话或凭证，进而在用户不知情的情况下控制其账户。传统的会话 Cookie 一旦被窃取，攻击者往往可以在任意设备上重放使用，绕过密码甚至多因素认证。Chrome 此次采用的设备绑定凭证思路，是在会话建立时加入与设备硬件或系统状态相关的绑定信息，使得凭证离开原设备后失效或无法通过验证。
从技术逻辑上看，设备绑定会话凭证并非全新概念，此前已有浏览器厂商和安全社区讨论过类似方案。但 Ars Technica 将其评价为“可能是目前最好的账户接管防护之一”，主要在于它直接针对了凭证可移植性这一长期存在的薄弱环节。原文未提供 Chrome 具体实现细节、推出时间表或覆盖版本范围，相关技术参数有待后续官方说明。
这一变化也反映出浏览器在账户安全中的角色正在从单纯的“入口”转向更主动的“防护层”。当攻击者无法轻易将窃取的会话转移到其他设备时，钓鱼攻击的实际收益将明显下降。不过，设备绑定也可能带来跨设备登录体验上的调整，用户在新设备上登录时可能需要额外的验证步骤。原文未提供关于用户体验影响或兼容性限制的更多信息。
References
Original source text
Google’s Chrome browser has added a new feature that could go a long way in preventing a form of account takeover that’s grown increasingly common as users adopt two-factor authentication, passkeys, and similar protections.
The new Chrome protection is known as device-bound session credentials (DBSCs). The measure stores a unique encryption key in a silicon-resident fortress that’s built into the device running the browser. On Windows machines, this fortress is called a TPM, short for Trusted Platform Module. On macOS and iOS, it’s known as a secure enclave. Other platforms have differing names. Recently released versions of Chrome for Windows and macOS generate a key that’s stored in this fortress.
An antidote to session cookie theft DBSCs protect against the theft of session cookies, the unique strings of characters that websites store on browsers. Session cookies greatly speed up browsing on sensitive sites that require user authentication. Instead of requiring the exchange of credentials each time a user opens a new site page, the server sets a session cookie that effectively proves the user has already successfully logged in.