Top all-time · #13732
Posts on joonas.fi
Personal blog · joonas.fisecuritysystems
Posts on joonas.fi is a personal blog at joonas.fi about security and systems. Since 2021, 5 different Hacker News readers have linked it 6 times, most often “SAML Is Insecure by Design”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link joonas.fi mainly for its argument that SAML is insecure by design, including the point to sign bytes rather than meanings. Commenters cite it when discussing SAML and OAuth.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Let’s get to work ᕕ( ᐛ )ᕗ
Most-linked posts?
- SAML Is Insecure by Design3 people · 4 mentions · first linked 2021-08-04
What Hacker News says?
Saml is insecure by design. Others have said it better before me, such as https://joonas.fi/2021/08/saml-is-insecure-by-design/ , but the quote I got from an old thread here was "Sign Bytes, not meanings". Parser differentials are expected and even necessary. What you intend to get from a signed response is very meaningful. A dilemma in modern TLS is that sometimes you want to trust one internal CA; That's the easy…
Comment linking /2021/08/saml-is-insecure-by-design/
on “Sign in as anyone: Bypassing SAML SSO authentication with parser differentials”Submitted SAML Is Insecure by Design as a story · 300 points
HN discussionHere's an interesting blog post on why SAML is insecure by design: https://joonas.fi/2021/08/saml-is-insecure-by-design/ Malleability sucks in this context.
Comment linking /2021/08/saml-is-insecure-by-design/
on “A Gentle Introduction to SAML”Submitted SAML Is Insecure by Design as a story · 3 points
HN discussionYou need OAuth and not to use SAML. Saml is insecure by design: https://joonas.fi/2021/08/saml-is-insecure-by-design/
Comment linking /2021/08/saml-is-insecure-by-design/
on “You don’t need to be “enterprise-ready” or “scalable””Submitted UEFI, PC boot process and UEFI with QEMU as a story · 1 points
HN discussion