“It's even worse on the data deserialization side because, man, we've got so much old code out there that's dependent on the developers encoding a dataset in.NET and tossing it in a cookie or tossing it in a hidden input.”

Transcript evidence from Bill Sempf -- Insecure Deserialization.