That seems right intuitively, but in existing TLS, there is a way that this can also be used to attack your communications with a third-party site. It is described in papers that were published at<p><a href="https:&#x2F;&#x2F;secure-resumption.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;secure-resumption.com&#x2F;</a><p>although that site seems to be down right now.<p>While people can agree that this is ultimately a flaw in the design of the TLS protocol, in some contexts, it&#x27;s still a reason that it matters whether your connection with an arbitrary site is using a safe Diffie-Hellman group or not.