Device-Bound Session Tokens

[u/ImpressionOk2334]

Please add device-bound sessions/tokens. I don’t want stolen cookies or tokens to be usable on another device.

The goal: stealing a session token should not be enough to access the account. The session should be cryptographically bound to the device that created it.

This would be especially valuable for protecting Proton accounts against infostealers, session-cookie theft and token replay, while still allowing users to have multiple legitimate devices.

[u/West_Possible_7969]

Proton has already a layered process that works cross platform and is always on. Of course in zero knowledge systems using an app and not the browser is the safest thing to do, but DBSC is a some months old thing that works in some browsers, in some OSes, and in devices with TPM / secure enclave only.

[u/ephemeralmiko]

I thought this was already part of Sentinel? If not then I second that Proton should incorporate this ASAP.

https://proton.me/blog/sentinel-high-security-program

[u/fommuz → u/ephemeralmiko]

hmmm, there is no mention about DBSC or something similar in this article!?

it’s a pretty new web standard and Chrome has it since v. 146 (march / april 2026):

https://www.w3.org/TR/dbsc/

[u/Skaifessurk → u/ephemeralmiko]

I think Sentinel flags suspicious activity but doesnt do actual cryptographic binding of sessions to hardware

[u/thepixel-geek]

Yes please

[u/Extravi]

I was thinking about this a while ago. I think this is only supported for Chromium browsers. However, this definitely should be a part of Proton Sentinel. If not, just on by default, if available.

[u/ImpressionOk2334 → u/Extravi]

this is basic and essential security, this should be for everyone and not optional

[u/Cyanogen101 → u/ImpressionOk2334]

"basic and essential"

But new and not supported by multiple softwares and many sites.

It's good and important yes

[u/West_Possible_7969 → u/ImpressionOk2334]

It cannot be for everyone and it is not basic, because it does not, and cannot, work everywhere.

[u/Hungry-Broccoli-7193]

That - and/or aggressive reauthentication if a specific session switches IP addresses.