I've always wondered if / what is stopping someone from eves dropping or duping the initial handshakes before the communications are encrypted. If you get the cipher and understand the schema used you should be able to decode the otherwise secure traffic.
in step 4 above the client sends data to the server that is encrypted with the server's public key. you don't have the server's private key, so you cannot decrypt that data. but the server can. so you cannot duplicate things, even if you are watching.
