Hacker News new | ask | show | jobs
by ralala 625 days ago
OIDC is newer and many of the issues with SAML were addressed in the architecture. However I’m curious to hear which attack vectors you are thinking about.
1 comments
tptacek 625 days ago
Most obviously, the precarity of XMLDSIG.
link
ralala 625 days ago
This is where artifact binding can greatly increase the security….

Browser sends artifact to RP, RP fetches assertion from IdP via HTTPs, afterwards verifies the signature.

Signature verification is not implemented correctly? The attacker still needs to break HTTPS…. And then you would have a big problem anyway.

link
tptacek 625 days ago
A common pattern of SAML vulnerability is one that allows logins from one org access to resources of another org, which is not mitigated by trusting IdP's.
link