As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they are HTTPS urls. This is a problem especially when those URLs contain secrets, which happens more often than one might think. It will be described more at the Black Hat security conference in Las Vegas in a talk titled Crippling HTTPS with Unholy PAC.
According to How to Disable WPAD on Your PC So Your HTTPS Traffic Won't Be Vulnerable to the Latest SSL Attack « Null Byte, WPAD is enabled by default with Internet Explorer, but not in Mac OS X or Linux, nor on Safari, Chrome, or Firefox browsers.
That article gives instructions for how to disable WPAD in Windows. But how can I check whether it has been enabled on other browsers or operating systems in my organization? And are there other settings to look at, e.g. around PAC?