Subject: [TLS] Interesting client behavior

From: Michael D'Errico <[email-masked]>
Date: Fri, 20 Nov 2009 09:59:06 -0800

I have noticed over the past couple days that there has
been a change in the "signature" of clients connecting
to my test server.  You can tell by the sequence of
connections which browser it is in many cases.

However a new pattern appeared in which a client asks
for the home page using TLS 1.0, and then uses SSLv3 to
fetch favicon.ico.  I won't mention which one it is,
but it's the most recent version of that browser.

I wonder if this is the result of changes made to
address the renegotiation problem....

Mike