[lazyjones]

> Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works.

OK, I guess I was reading too much into the (not very enlightening) definition of PFS on Wikipedia and too little of the actual implementation based on Diffie-Hellman, which has the desired properties.

The question that arises is: how feasible is a MITM attack on this phase of session initiation? Can it be kept undetected?

[tonfa]

With channel id, it would need to share the state even as laptops move across networks.