News for hackers. Stuff that matters.

A comment on Okta Exposes Passwords in Clear Text for Possible Theft. Parent comment

Re:Okta Exposes Passwords in Clear Text for Possible Theft by jf on Sunday September 25, 2022 @02:56AM (#32969475)
The short version of why SAML is bad is because it’s based on XML. This means that SAML is not only subject to the usual vulnerabilities that you’d expect, but also XML vulnerabilities!

A slightly longer explanation is that SAML is based on a garbage cryptographic signature standard called “XML-DSig” which, among other issues, allows for partial signatures and stores the signature inside the XML element that it signed.

Honestly, SAML is something of an info hazard. I don’t recommend learning more about it. But if you really want to, this blog post goes into more detail: https://dev.to/workos/fun-with-saml-sso-vulnerabilities-and-...

[ Parent | on HN ]
Re:Okta Exposes Passwords in Clear Text for Possible Theft by deepakprab on Tuesday September 27, 2022 @06:20PM (#33001884)
We (BoxyHQ) are an SSO and Directory Sync vendor like WorkOS and they are spot on with the details of the SAML vulnerabilities. We have guarded against these attacks so our customers don't have to but plenty of companies still roll out their own implementations, not all of them securely.
[ Parent | on HN ]