SAML is the XML that logs you into almost every work app you use, and it has a design quirk that keeps producing the same security bug: the signature lives inside the document it signs. In 2012 researchers tested fourteen SAML frameworks and broke eleven with one trick, XML signature wrapping. Last week a Trail of Bits post, "SAML: A fractal of bad design" , argued it is time to retire the protocol. If you sell software to companies, somebody will ask you for SAML, so here is how it works and w...