> Of the 321 sites supporting both SSL3 and TLS1, 86 (27%) chose different security parameters under downgrade conditions. Of these downgrades, 70 (81%) repres

> Of the 321 sites supporting both SSL3 and TLS1, 86 (27%) chose different security parameters under downgrade conditions. Of these downgrades, 70 (81%) represented attacker-controlled loss of forward secrecy. So this is the real problem - a minority of servers are misconfigured and won't use a cipher with forward secrecy under SSLv3. I just checked www.cloudflare.com and www.google.com and both use ECDHE even under SSLv3. It would be really dangerous if browsers were willing to downgrade to SSLv2, which has no protection of handshake traffic, but SSLv2 has been disabled by default in browsers for years (Firefox even removed support for it altogether in FF8).