Daniel Stinson @shellcromancer

Building a new product! Used to do security engineering @ Brex, and Cloudflare. Dogs are better than people. shellcromancer.io Austin, TX Joined June 2018

Tweets

407
Followers

1K
Following

3K
Likes

13K

Kuba Gretzky @mrgretzky

4 days ago

I wanted to address the speculation about the recently introduced Device Bound Session Credentials (DBSC) security feature in Google Chrome. Does it help increase the security of session cookies against infostealer malware and MFA phishing? The feature has been available and enabled by default since the Chrome 146 update (April 2026), if you're running Windows with a hardware-backed TPM security module (macOS support is coming in future updates). DBSC allows the browser to upgrade session cookies from long-lived to short-lived, requiring the browser to refresh them approximately every 10 minutes to maintain access to the user's account. > Does DBSC prevent account takeover by threat actors using a stolen session cookie obtained from the user's browser via infostealer malware? Yes (kind of). The extracted session cookie will be valid for up to 10 minutes from the time it is extracted. The attacker will be unable to maintain long-term access to the user's account. Still, the timeframe may be sufficient, for example, to exfiltrate the inbox if the attack is automated. The attacker cannot refresh the short-lived session cookie because it requires the private key (stored in the TPM) assigned to the account to sign the challenge. The malware cannot access the private keys stored in the TPM. > Does DBSC prevent account takeover by threat actors during a phishing attack? No. Servers need to provide legacy support for the browsers that do not yet support DBSC. By default, the server registers and sends a long-lived session cookie to the browser. If the server supports DBSC, it will announce the DBSC API endpoint URL in the `Secure-Session-Registration` HTTP header of the response packet that contains the long-lived session cookies. Only after the short-lived session cookie is registered via the DBSC API endpoint is the long-lived session cookie invalidated. When the attacker removes the `Secure-Session-Registration` HTTP header retrieved from the server during a phishing attack, the browser will continue using long-lived session cookies and assume the server does not support DBSC. In short, removing that HTTP header while proxying traffic during a phishing attack allows the attacker to maintain long-term access to the user's account using the stolen long-lived session cookie. I hope I've managed to clear up some confusion. On a related note, you will soon be able to simulate phishing attacks against Google Workspace accounts (and other websites) that bypass DBSC and MFA protections using Evilginx Pro with the Phishlets 2.0 update.

Xavier Rivera @XavierRiveraX

a week ago

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

104 319 4K 505K 902

4 39 133 25K 85

View Details

Daniel Stinson @shellcromancer

5 days ago

I don’t even think any major MDM provider has purpose built configuration for Passkey Attestation? Don’t see a way to do it at all with Iru. Might work with custom declaration profiles in Jamf and Fleet 🤔

0 0 1 154 1

View Details

Daniel Stinson @shellcromancer

5 days ago

This. Apple released Declarative Device Management in 2021, then in 2023 they released enterprise passkey attestation to prove a passkey registration comes from a managed device. Only way you can do it is with DDM… But Apple Business MDM from 2026 doesn’t support DDM :(

Arian van Putten @ProgrammerDude

5 days ago

So Apple now has its own MDM "Apple Business". I would've expected it to use all the modern new Apple features like Managed Device Attestation for enrollment and Declarative Device Management. But nope. It's just shitty Configuration Profiles + SCEP

2 0 19 4K 3

2 0 2 974 0

View Details

Daniel Stinson @shellcromancer

7 days ago

@deno_land Does this also improve performance for the Deno.serve APIs? 👀

0 0 0 156 0

View Details

Daniel Stinson @shellcromancer

7 days ago

@XavierRiveraX @RGB_Lights To all *Windows users… hopefully macOS Chrome and alternative browsers follow quick!

0 0 3 207 0

View Details

Kyle Polley @kpolley

2 weeks ago

The industry has seen an unprecedented wave of supply chain attacks over the past few months. That's why we built Bumblebee, a lightweight security scanner that continuously monitors endpoints and hunts for malicious packages. Bumblebee has been a critical asset in keeping @perplexity_ai secure, and we're thrilled to open source it for everyone. We're also using Perplexity Computer to monitor public threat intelligence feeds in real time and update the Bumblebee repo as new threats emerge. Excited to share this with the community!

Perplexity @perplexity_ai

2 weeks ago

Today we're open-sourcing Bumblebee, a read-only scanner for macOS and Linux. It checks developer machines for risky packages, extensions, and AI tool configs. Connected to Computer, it can trigger deeper scans whenever a new supply-chain risk emerges. github.com/perplexityai/b…

182 705 5K 1.5M 6K

11 48 435 100K 460

View Details

Daniel Stinson @shellcromancer

3 weeks ago

[1] support.claude.com/en/articles/13… [2] developers.cloudflare.com/cloudflare-one…

0 0 1 24 0

View Details

Daniel Stinson @shellcromancer

3 weeks ago

@Cloudflare Zero Trust should add examples on how to enforce Anthropic Tenant Restrictions [1] with Cloudflare Gateway 👀 Seems like it's possible with Gateway Tenant Control [2] policies but not in either Cloudflare or Anthropics docs cc @Encore_Encore @dok2001

1 0 2 228 1

View Details

Daniel Stinson @shellcromancer

4 weeks ago

@rjonesy trial.mts.now

0 0 1 155 0

View Details

Daniel Stinson @shellcromancer

a month ago

@cramforce Eager for it to move from Windows to macOS. Will be huge if @webkit & @mozilla can agree to ship. Other browser engine tracking issues linked here: github.com/w3ctag/design-…

0 0 1 218 1

View Details

Socket @SocketSecurity

a month ago

🚀 Big news: Socket has acquired Secure Annex. John @tuckner is joining the team, and we’re excited to expand our coverage across browsers, code editors, and AI tools. Read more → socket.dev/blog/socket-ac…

6 7 52 6K 7

View Details

Daniel Stinson @shellcromancer

a month ago

Best extension scanning 🤝 Best dependency scanning Congrats to @tuckner, @feross and all the customers!

tuckner @tuckner

a month ago

Today we're announcing that @secureannex has been acquired by @SocketSecurity! Supply chain security is a deceptively wide problem from open source code to browser extensions. Developers and IT teams can't stop it from impacting their organization alone. secureannex.com/blog/annex-acq…

22 5 98 25K 14

0 0 10 1K 0

View Details

Daniel Stinson @shellcromancer

a month ago

@tuckner

1 0 2 121 0

View Details

Daniel Stinson @shellcromancer

2 months ago

@chenliw Yes! The admin knob is @ admin.google.com/ac/owl/settings End-users can "Request Access" in the blocked page during the consent flow. Without a custom Activity rule in Alert Center no one is getting alerts when users ask for apps. 🤦‍♂️

0 0 0 81 0

View Details

Daniel Stinson @shellcromancer

2 months ago

Is it expected that Google Workspace admins don't even get notifications when users requests apps? Seems incredibly silly there is no notification mechanism for this... Pretty easy to make an Alert Center rule but these sort of things should be on by default!

ChenLi W @chenliw

2 months ago

Spent my Sunday evening doing this - recommended for all Google workspace admins! Also go to admin.google.com/ac/sc/investig…, select OAuth log events, to see what else is getting rejected. Can pull OAuth client IDs from the logs to allowlist. Google should really make this easier!

1 0 8 4K 11

2 0 9 3K 7

View Details

Daniel Stinson @shellcromancer

2 months ago

@zeddotdev search in preview 🔎 github.com/zed-industries…

0 0 0 545 0

View Details

Daniel Stinson @shellcromancer

2 months ago

> The refactor itself typechecks conceptually; Name that Agent!

0 0 4 86 0

View Details

Daniel Stinson @shellcromancer

2 months ago

Big day: toddler’s first data breach!

1 0 12 921 0

View Details

Logan Carmody @endorseurgirl

3 months ago

We at @cotoolai are stoked to announce our $7.4m fundraise from @a16z . Offensive cyber operations are now JIT code; we started Cotool to give defenders their leverage back. Grateful to everyone who took the bet early, especially @koomen @garrytan @MaikaThoughts @zanelackey.

1 3 12 462 1

View Details

Rustam X. Lalkaka @lalkaka

4 months ago

Today we're introducing @usefiretiger. You and your AI agents write code. Firetiger makes sure it works. Our team and I have plenty of incident war stories building @Cloudflare, @segment, @Twitch. In the agentic coding era, the volume of code changes + quality issues in prod is ever increasing, but observability vendors aren't incentivized to close the gap. They make money when you write more data to them, not when your software actually works. Firetiger is the agentic operations layer for the agentic coding era. We combine production observability data, codebase understanding, and knowledge of your business to find problems before your customers do and fix them before they notice. We've raised $7.6 million led by @sequoia with participation from angels who believe in better software, including @eastdakota, @calvinfo, @NicoRosberg, @dok2001, @jeffawilke, and @alanaagoyal. You can sign up for @usefiretiger today, self serve. We charge for agents that directly make your software better and more reliable, not for observability data ingested, with plans starting at $599/month. Observability is dead. Long live outcome engineering.