We deleted a 63 MB GeoIP database and replaced it with a 64-byte signature

A security engineering team replaced an unenforced device-fingerprinting system, which relied on request headers and GeoIP data but could neither reliably identify attackers nor avoid disrupting mobile and VPN users, with browser-generated proof-of-possession keys that bind sessions to non-extractable WebCrypto credentials. After login, the browser registers an ECDSA P-256 public key with the server and signs authenticated requests, preventing a stolen cookie alone from being used elsewhere, although copied browser profiles and live cross-site scripting attacks remain significant limitations. Implementing the system exposed practical issues including WebCrypto and Python signature-format differences, incomplete request coverage, replay risks from a five-minute timestamp window, OAuth route exemptions, CSRF-like logout vulnerabilities, and a path-handling bug that initially caused all proofs to fail. The team used account-level counting mode before enforcement to limit rollout risk, removed obsolete fingerprinting dependencies and a 63 MB GeoIP database, and added protections for sensitive navigation routes using Fetch Metadata headers. The author concludes that the custom mechanism resembles the DPoP standard and should eventually be replaced where possible by Chrome’s Device Bound Session Credentials, which uses hardware-backed keys and short-lived cookie refreshes without application-level signing code, though its current lack of Firefox and Safari support requires a transitional approach.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.