> The downside (to me, not to you) is that the attack has limited impact. I agree, although I think the break of channel bindings is going to turn up some inte

> The downside (to me, not to you) is that the attack has limited impact. I agree, although I think the break of channel bindings is going to turn up some interesting cases that are harder to fix than client-cert auth in browsers.