There are three different ways how TLS (1.2) can be used:
- server and client authenticate
- only the server authenticates
- neither authenticates
If neither server nor client authenticates using a certificate the connection is not protected against man-in-the-middle (MITM) attacks.
The TLS 1.2 specification says that the connection is safe as soon as the server authenticates. And I wonder:
Does it make any security difference whether the client authenticates or not if the server authenticates?
If both the client and the server need to authenticate, does it matter whether the client sends a trusted certificate in the handshake or just sends a secret (and strong) password as application data?