Comment 44 for bug 309402

poy (poy) wrote :

sure, but by that time it would have been determined (with the PID / CID check) that user B is in fact the same as user A.

user B never actually appears in the user list; it is just a connection from user A in which a SUP and an INF are sent. the INF can be trimmed to only containing the PID, CID (and if a custom IP is configured, an IP). once the PID&CID have been verified, that "user B" connection is disconnected and the IP is transferred over to user A's INF.