Hacker News new | past | comments | ask | show | jobs | submit
Then connect the browser directly to the secure element of the device, so the session cookie is cryptographically signed by something you are physically in possession of.