Need to go now, but here is my another $0.02 on this: yes, complex enterprise networks really benefited from WPAD (at least for some time) yes, it is primaril

Need to go now, but here is my another $0.02 on this: yes, complex enterprise networks really benefited from WPAD (at least for some time) yes, it is primarily Windows because... well, because it was implemented there and yes, it's not used in *nix-like because for 99% of time any of them are not in the AD and doesn't support NLTM SSO, so on any Windows machine you get a seamless and silent auth on proxy, while any *nix-like at best nagged you for credentials with an explicit modal. Oh, you restarted your browser? Who are you? Can you provide your credentials? > if the company stuff is set up right, there's nothing any of those URLs could grab. Or better, tack on some always-on VPN or whatnot when not on the trusted network and all the better. yes, just like in any other case, a proper planning (preferably done before deployment) is a key for a proper security, by not having an attack surface in the first place.