BYOD doesn't affect this. If you're on your own device and you connect to Google.com via the company's network, PFS or not, the workplace can't intercept. You'l

BYOD doesn't affect this. If you're on your own device and you connect to Google.com via the company's network, PFS or not, the workplace can't intercept. You'll either get blocked (not using their proxy), or get a CA error (their MITM system can't trick your phone into thinking their self-issued cert is valid). This is true with or without PFS. You'll still have to install the workplace's CA, and then they'll continue to MITM you, like they do today. Or, just use your cell connection and bypass it all. It'd only change if you're connecting to sites the workplace controls and has the private keys for, that you trust (i.e., they get a cert issues by Digicert then disable PFS on their webserver). This isn't what enterprises are upset about.