OAuth vs. SAML vs. OpenID Connect

Re:OAuth vs. SAML vs. OpenID Connect by chris_wot on Friday December 09, 2016 @03:19AM (#13137444)

The fact they have a "catch all" DNS resolver for an SSL-based website that is an interface for admins and end users alike that is guaranteed to fail says a lot about their ability to sell a secure product.

[ Parent | on HN ]

Re:OAuth vs. SAML vs. OpenID Connect by cyberpunk on Saturday December 10, 2016 @06:06PM (#13148430)

And how else would you let your users have a subdomain login url? Why bother generating specific certs and dns for each when you can just use the HOST header for the login and use a wildcard?

This is totally common and used in a lot of places..

I mean:

https://bigger.bag.of.dicks.signin.aws.amazon.com/

[ Parent | on HN ]

Re:OAuth vs. SAML vs. OpenID Connect by chris_wot on Sunday December 11, 2016 @04:40AM (#13150352)

Because those Certs weren't designed for this scenario.

The fact that you can create that domain name to resolve is funny. I can think of a few phishing schemes I could use with this, if I were so inclined.

[ Parent | on HN ]

Re:OAuth vs. SAML vs. OpenID Connect by cyberpunk on Sunday December 11, 2016 @02:32PM (#13152689)

This was designed for exactly that sort of scenario. If you're runnin a SAAS then this is totally common practice, it's used by at least AWS, Slack, and GitHub off the top of my head.. Are you saying these companies are doing something stupid?

How could you phish github or aws by using their dns/cert setup as they intended it to be used?

[ Parent | on HN ]