Device-bound session credentials thwart an increasingly common form of account takeover. For anyone curious this is being worked on as a W3C standard and the work for ...