* Eddy Nigg:
I believe this to be a mistake for various reasons, but first and
foremost because an attack on a server without compromise of the
client data as well, is basically useless. When a attacker induces
renegotiation at the server, the attacker must have client credentials
in order
[ Please follow up to mozilla.dev.tech.crypto ]
After some discussion at bug 554594 I'm following up here - the bug was
unfortunately misused by me a little for the initial discussion.
At https://wiki.mozilla.org/Security:Renegotiation under item 4.4 the
following is proposed:
