Then you must replace all traffic to that site successfully. The keys for the spoofed and the legitimate certificate will be different. With PFS only traffic wi

Then you must replace all traffic to that site successfully. The keys for the spoofed and the legitimate certificate will be different. With PFS only traffic with the negotiated key can be decrypted by the browser. Without PFS, the legitimate server will not understand your requests. Quantum Insert is not successful for each request, as stated by the article. Therefore I would assume that at least a few packages of the original server would slip through which then cannot be decrypted or contain an error message of the server. Especially targeted administrators would notice very quickly, I assume (although browsers might suppress those packages silently). Therefore this would work only with a full man-in-the-middle. I think in general https would work against this particular attack, if you don't accept sites with mixed content (I am not aware of any browser plugin which does suppress plain content on mixed sites).