unencrypted assertions not working

[Peter Schober]

* Mark K. Miller <max at psu.edu> [2013-04-03 16:21]:
> It's my opinion that its always best to guide new services in a
> direction that will require the least effort for them and their
> future business partners.

(Skewing the topic or argument considerably:)

Following that deploying SAML would have never happended, I think,
even in the modest scale we see today. It would also preclude doing
anything /better/ (from IdP discovery to error handling) if it
requires effort.
Maybe doing /anything/ can be broken down to whether it reduces effort
or costs. In which case I'd probably still not agree that least-effort
is always best (for whatever values of "best").
That might work for much in security space (security not being an end
in itself), much less so with e.g. privacy.

Encrypting data during transfer over untrusted networks should not be
done (only) because it's the easiest or most convenient thing to do.
Though admittedly that helps / would help.

cheers,
-peter