Joonas Bergius • 8/3/2021

SAML is insecure by design

This article provides a technical critique of the Security Assertion Markup Language (SAML), a standard for single sign-on. It argues that SAML's security design is fundamentally flawed because it relies on signing computed values, making it malleable and vulnerable to exploitation. The author explains the concept with examples, references catastrophic vulnerabilities in real systems like government services, and contrasts it with the desired property of non-malleability in secure systems.

0 comments

#security #authentication #web security