Trail of Bits urges SAML deprecation, OIDC migration

// 1h agoNEWS

Trail of Bits urges SAML deprecation, OIDC migration

Trail of Bits published an architectural critique detailing why SAML's reliance on XML canonicalization and enveloped signatures creates intractable security vulnerabilities like signature wrapping attacks. The firm urges organizations and identity providers to retire the 25-year-old protocol and migrate to OpenID Connect.

// ANALYSIS

SAML is enterprise security's ultimate sunk-cost fallacy, surviving on legacy inertia despite decades of unfixable XML parser differentials and signature vulnerabilities.

–Enveloped signatures are structurally flawed because inserting signatures into the payload being signed makes canonicalization and signature verification deeply fragile.
–OpenID Connect (OIDC) fixes the foundation by using detached signatures and delegating transport encryption to standard HTTPS rather than creating complex XML abstractions.
–Cloud-native companies like Tailscale and Fly.io prove modern vendors can successfully hold the line on OIDC-only authentication without caving to enterprise SAML demands.
–While service providers can adopt OIDC relatively quickly, identity providers face a grueling multi-year migration roadmap across entrenched enterprise customer bases.

// TAGS

samloidcsecuritydevtoolcloudapi

DISCOVERED

1h ago

2026-09-22

PUBLISHED

3h ago

2026-09-22

RELEVANCE

5/ 10

AUTHOR

aray07

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

UPDATE20m ago

Grok Bot desktop app ships 53 performance improvements

The desktop application for Grok Bot has shipped 53 performance optimizations over the past few days to dramatically reduce latency across core workflows. Key improvements include cutting network reconnection times after a flaky connection from 60 seconds to 0.7 seconds, reducing laptop wake recovery from 23 seconds down to 1 second, and bringing the transition time when switching back to the Computer view down to 868 milliseconds.

INFRA1h ago

Boat ships small 5GHz agent sandboxes

Boat has rolled out its small sandbox tier featuring 2 vCPUs clocked at 5GHz, 4GB RAM, and 12GB disk for $0.000005 per second ($0.018/hour). The persistent Ubuntu environments target AI agent workloads with zero-disk-cost snapshots, preinstalled devtools, and concurrency scaling up to 2,000 instances.

INFRA1h ago

Astra finds 14-year-old libuv memory leak

After investigating intermittent ChatGPT desktop crashes on macOS, developer Peter Steinberger prompted AI agent Astra to inspect system crash logs and trace native stack traces down to a 14-year-old memory leak in libuv's Darwin filesystem watcher. Pull request #5283 resolves the bug by releasing uncollected Core Foundation objects and C path buffers across exit paths in `uv__fsevents_reschedule`, halting quadratic memory growth during watch churn.

Trail of Bits urges SAML deprecation, OIDC migration