Why MA-SSL has been introduced?

Question

If my knowledge is correct with respect to simple SSL, Mutually Authenticated-SSL has the advantage that both end parts are authenticated one to another:

Not only the Client endpoint knows that he is communicating with the Authenticated Server endpoint, but also the Server endpoint is sure that he is communicating data with Authenticated Client endpoint and not with a third party unauthorized (MITM).

My question is:

"In what kind of scenario will this grant a higher level of security in communication?"

In other terms:

"What kind of attack that a MITM can pursue in a communication based on simple SSL is completely avoided with MA-SSL?"

Answer 1

Reason 1 One kind of attack a mutually authenticated SSL connection would protect against is credential stealing XSS.

Typical SSL encrypted connections only authenticate the server. To authenticate the client, the user enters her username/password. Typically then, the user's session id is used to maintain that authenticated connection with the server.

An XSS attack could steal that session id and send it to the attacker. The attacker then uses that session id to gain access to the user's account without needing a password.

MA-SSL would protect against this as the client is authenticated (probably with a client certificate) and no session id is required.

Reason 2 Another reason for MA-SSL is that with the traditional deployment of SSL (server auth by cert, client auth by password), if a server can trick the client into believing the authenticity of the server (e.g., misspelling the domain by a single character and registering a valid certificate), when the client is authenticated, the server now has the ability to impersonate the client. MA protocols based on certificates are much easier to design in such a way that the server cannot impersonate the client after a successful authentication of the client.

NOTE: The use of MITM in the quote you posted seems wrong.