Kelby Ludwig - writing at Duo Lab's has just posted a fascinating blog entry detailing their recent discovery of SAML vulns potentially affecting a range of implementations and deployments. In this case, the vulnerability appears to be a zero knowledge scenario (of the attributes of the target's password). H/T
"This blog post describes a new vulnerability class that affects SAML-based single sign-on (SSO) systems. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim user’s password. - via Duo Lab's Kelby Ludwig
Via the inimitable Catalin Cimpanu, comes this tale of web-based subterfuge that should enrage all legitimate users on our vaunted interwebs. In this case, the use of hidden login fields (and their parent forms) used by evil usage trackers on seemingly legit sites. Is it any wonder that the effort to block both web advertising and the evil cousin to such: Web Trackers (both nefarious and otherwise) is a growth business in the browser addon market? Read it and Weep My Friends, for the demise of both privacy and your personal authentication data.
"The two services are Adthink (audienceinsights.net) and OnAudience (behavioralengine.com), and Princeton researchers said they identified scripts from these two that collected login info on 1,110 sites found on the Alexa Top 1 Million sites list.' - via Catalin Cimpanu writing at Bleeping Computer
Dr. Jaap-Henk Hoepman's security posts (via his blog), detailing his provocative yet fundamentally sound thoughts on the subject of terminating the utilization of certificates is today's absolute MustRead.
The basic idea - A few days ago I explained the idea including a mechanism to detect phishing attacks. This makes the protocol more complex, and creates confusion. So let’s try again, explaining the basic idea first. Whenever a browser sets up a new TLS connection with a domain, the web server serving that domain respond with its public key (instead of a certificate, as is currently the case) in the initial TLS handshake. (This is more precise than saying that the web server sends its public key in the header of every page it sends.)... Read more at Dr. Hoepman' blog
Perhaps a good idea for the Nigerians. Nevertheless, it is doubtful the Nigerian spammers will be hampered by the newly implemented national ID system... The interesting news, of course was announced via a press release, is the assistance bestowed on the Federal Republic of Nigeria by MasterCard Incorporated (NYSE:MA) .