RE: [security-services] SAML2.0 in the news (SolarWinds hack)

[Thomas Hardjono <hardjono@mit.edu>]

Hi Leif, Scott,

Seems that 20 years later the world is still seeing the same "security challenges" over and over again.

-- thomas --

________________________________________
From: security-services@lists.oasis-open.org [security-services@lists.oasis-open.org] on behalf of Cantor, Scott [cantor.2@osu.edu]
Sent: Thursday, January 14, 2021 8:48 AM
To: Leif Johansson; security-services@lists.oasis-open.org
Subject: Re: [security-services] SAML2.0 in the news (SolarWinds hack)

On 1/14/21, 3:43 AM, "security-services@lists.oasis-open.org on behalf of Leif Johansson" <security-services@lists.oasis-open.org on behalf of leifj@sunet.se> wrote:

>    Maybe the SSTC should "put out a statement" (T-shirt?9 saying "its about the keys stupid"

I'd probably go with "sorry artifacts sucked", but I probably still wouldn't have (and wouldn't now) deploy a back channel myself.

-- Scott