zlacker

It's not that the PFS is known to be broken, it's that it's actually still very rarely used (1)

The present is problematic enough, we don't even need to hypothesize on the future breakages.

1) http://en.wikipedia.org/wiki/Forward_secrecy

"As of December 2014, 20.0% of TLS-enabled websites are configured to use cipher suites that provide forward secrecy to web browsers."

IPSEC is also often configured with the disabled PFS, even if the RFC is from 1998 ( http://tools.ietf.org/html/rfc2412 )