SAML: A Fractal of Bad Design

The article discusses the flaws in the Security Assertion Markup Language (SAML) protocol, a widely used standard for authentication and authorization. The author argues that SAML's design is flawed, leading to a number of security vulnerabilities and issues. The issues include the use of XML, reliance on human review, and the lack of a robust error handling mechanism. The article also cites examples of SAML's flaws in real-world scenarios, including the use of SAML in the OAuth 2.0 protocol. The author concludes that SAML's design is a 'fractal of bad design', meaning that it is a self-replicating problem that perpetuates a flawed approach to security.