That’s a pretty interesting attack. The short version is that you have a client and server as the same endpoint, and TLS 1.3 allows you to use the same PreShar

That’s a pretty interesting attack. The short version is that you have a client and server as the same endpoint, and TLS 1.3 allows you to use the same PreSharedKey as a client and as a server. If you can be tricked by a man in the middle to be a client and a server at the same time - you would be talking to yourself using the same PSK on both ends. This means the attacker ‘could’ cause trouble if the messages you meant to send to someone else are valid messages you could also act on like “please delete this file”. I didn’t see where the PSK was lost anywhere. Only the situation that the message you send could be performed by you as if you had received it. Interesting, but seemed limited in scope. I’m also not seeing where the attacker ever understands the message they echo. They would just have to hope it caused problems.