3 ms·
Mostly yes. But the SAML spec itself also has too many degrees of freedom, which just means too many potential bugs. SAML could get rid of 90% of the spec and s
by kabes 5y ago
Mostly yes. But the SAML spec itself also has too many degrees of freedom, which just means too many potential bugs. SAML could get rid of 90% of the spec and still support 99% of what it is used for, while having way less security pitfalls.
- rstuart4133 5y agoThe same could be said for x509 - so much crud for what boils down to a 3rd party signing a domain name asserting you have control over it. The unneeded complexity causes innumerable interoperability problems. As for the problems caused by ambiguous representations, the most memorable one for me was the bitcoin malleability problem which boiled down to a thing people based a transaction ID on having multiple representations. Bitcoin used DER format precisely because it isn't supposed to allow multiple representations of the same thing mind you - that bug was created by openssl following John Postel's advice "be conservative in what you do, be liberal in what you accept".