Oh, I only meant that with SAML, the SP has to deal with maliciously-constructed assertions. A buggy SP (and as the comments on this article show, these are com

Oh, I only meant that with SAML, the SP has to deal with maliciously-constructed assertions. A buggy SP (and as the comments on this article show, these are common) can be fooled into allowing an attacker to bypass authentication. Thereby making it a little bit too easy for users to log in. ;)