security-services message

Subject: Analysis reveals flaws at popular Web SSO sites

From: prateek mishra <prateek.mishra@oracle.com>
To: security-services@lists.oasis-open.org
Date: Wed, 28 Mar 2012 16:04:37 -0400

Some highlights -

1) its based on actual deployment traces at popular authenticationwebsites (Google, Facebook etc)


2) Requiring use of TLS does not remedy the flaws

3) I wonder how relevant these attacks are to SAML Web SSO

https://research.microsoft.com/pubs/160659/websso-final.pdf

References:
- Re: [security-services] Proposed Enhancement for Dynamic Attribute Queries
  - From: "Cantor, Scott" <cantor.2@osu.edu>
- Re: [security-services] Proposed Enhancement for Dynamic Attribute Queries
  - From: David Chadwick <d.w.chadwick@kent.ac.uk>
- Re: [security-services] Proposed Enhancement for Dynamic Attribute Queries
  - From: Leif Johansson <leifj@sunet.se>
- Re: [security-services] Proposed Enhancement for Dynamic Attribute Queries
  - From: David Chadwick <d.w.chadwick@kent.ac.uk>