I would avoid it on domain connected devices. Active directory will by default attempt to connect to arbitrary smb servers (via netbios, dns, or http pitm). Onc

I would avoid it on domain connected devices. Active directory will by default attempt to connect to arbitrary smb servers (via netbios, dns, or http pitm). Once connected it will happily throw your password hash, rehashed as netntlmv2, dictionary attacks and now entropy brute forces are possible, after which they can be leveraged for varying types of badness. PITM is remediated somewhat by HSTS which forms sort of a trust (google hsts mean https links to other resources cannot be tls downgraded, even if they don’t have a hsts directive themselves). Any lack of secure cookie flag can leak cookies over unencrypted http, wherever hsts is not applied on a site itself (even if you’re on hsts, an attacker could theoretically request to a http resource via any unencrypted page loading, by injecting an img resource to the victim domain). I doubt there’s any low scale attacks of the last two, but wouldn’t be surprised if nation states firewalls did this. The first attack vector is very real.