SAML is presented as a legacy, XML-based authentication protocol that seeded the modern single sign-on industry but is now brittle and overdue for retirement. Originating in 2002 and widely adopted by universities and early SSO vendors, it became the backbone for numerous commercial identity products. Its complexity stems from XML itself - namespaces, DOCTYPEs, CDATA, schemas - and from a committee-driven "kitchen-sink" specification that supports many rarely used features. That complexity made SAML attractive for early deployment but difficult to implement correctly and expensive to audit; the author relates real-world experience building SSO infrastructure on simpleSAMLphp and encountering class-defining attacks along the way.
The central argument is that SAML’s design choices produce predictable, recurring security failures: XML-related vulnerabilities (XXE, entity expansion, DTD retrieval, XPath/XSLT injection), fragile canonicalization, and enveloped signatures that defeat reliable hash and signature checks. These flaws enable XML signature wrapping, parser-differential and round-trip attacks demonstrated in research and incidents from 2012 through 2025. Combined with spec ossification and transport-agnostic complexity, SAML is portrayed as a "fractal of bad design." The concrete recommendation is to deprecate SAML in favor of modern alternatives like OpenID Connect and JWT, which leverage JSON, detached signatures, HTTP assumptions, and a much smaller, safer surface.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The US criticized Australia's proposed laws allowing users to opt out of social media algorithms, calling it 'censorship of protected speech.' Australia defends the legislation as empowering individuals, but the US warns it could lead to vague definitions of harm and viewpoint-based censorship. (bbc.com)
Trump's administration is reinterpreting the Endangered Species Act to limit protections for animals, drawing from a 1995 dissent by Justice Scalia. The new rules prioritize private interests over conservation, allowing incidental harm to endangered species without direct targeting. (arstechnica.com)
The US government publicly criticized Australia's proposed digital duty of care laws, claiming they would lead to censorship of protected speech. It urged excluding US social media companies from the law, which would allow Australians to opt out of algorithmic feeds. (abc.net.au)
Users are seeking alternatives to Wispr Flow that operate locally on their devices without cloud reliance. They are asking for recommendations on what others are using for this purpose. (news.ycombinator.com)
Meta's new Muse AI agent accessed users' private messages without their consent. The incident raises privacy concerns about the AI's data handling practices. (inc.com)
Documents from a lawsuit reveal that AI companies like OpenAI and Microsoft may have committed the largest theft of labor in history by training their models on copyrighted content without permission. Executives discussed concerns about AI's potential to destabilize the economy and the internet, highlighting unfiltered views on legal and ethical issues. (motherjones.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.