Shibboleth Developers

["Scott Cantor" <>]

> I only know of the Gross paper (2003) referenced on the OASIS SSTC
> home page.  Is there another?

A new one showed up, yes. This one actually avoids wasting as much time on
"gee, without SSL this isn't secure" and focuses on suggesting improvements,
but since I think use of artiact is shrinking commercially, I'm not sure if
anything will ever be changed or not.

Personally, I think it's a non-issue. Most attacks will be mounted against
the session at the SP, not the transfer. Ignoring that in the analysis just
seems odd to me.

-- Scott