News for hackers. Stuff that matters.
Re:SAML Is Insecure by Design by 1cvmask on Thursday August 05, 2021 @08:22PM (#28081784)
You framed the issue perfectly. A mismatch of competing incentives. That seems to be a problem everywhere beyond just security. it seems that bonuses should be tied to security as well. Then maybe software engineers would be incentivized to build things securely.

A clawback of bonuses for security vulnerabilities might be an interesting idea? Or better yet bigger bonuses if there are no breaches.

Re:SAML Is Insecure by Design by yourapostasy on Thursday August 05, 2021 @09:47PM (#28082382)
> A clawback of bonuses for security vulnerabilities might be an interesting idea? Or better yet bigger bonuses if there are no breaches.

Agency problem. Those who decide budgets and project timelines get the upside in such a bonus scheme, while whose who implement get the downside. Clawback bonuses, and the engineers not only get blamed, they get laid off to make the quarterly numbers for the management who want to make up for lost bonuses.

I suspect the solution lays in the spec complexity. Haven’t thought of this much, so my wrongthink knee jerk reaction is make a set of reference test harnesses part of the SOT of the spec, and that is the first step towards more robust implementations. Would like to hear how others have approached this problem space.

Re:SAML Is Insecure by Design by scrose on Friday August 06, 2021 @02:43AM (#28084015)
All this would accomplish is engineers feeling less like they should report issues with systems.