They're as secure as your ability to keep the private keys private, just like with server certs.
As far as MITM and PFS goes; that's handled just the same as regular SSL. Using a client cert doesn't affect that at all.
As far as MITM and PFS goes; that's handled just the same as regular SSL. Using a client cert doesn't affect that at all.
No real cert validation, forged certs, proxy replays. SSL is a joke.
As for cert validation / forged certs, they're only problematic because we want to authenticate a server we have never talked to before. With clients certs, the same doesn't apply: the server just needs to ensure the client is the same as the one who registered the account, so there's no need for the whole CA enchilada.
There's really no reason to only allow CA signed client certs.