DBSC off dbsc-off.cybersins.com
Ordinary bearer cookie
Signing in here sets a plain session cookie valid for 30 days. Anyone holding the cookie is the user, from any machine, until it expires. This is how most of the web still works.
What to compare
Sign in on both hosts, export the cookie from each, and replay it with curl from
a different machine. The unbound cookie works for a month. The bound one stops working in under two minutes
and cannot be renewed, because renewal needs a signature from a private key that never leaves the original device.