Editing Transport Layer Security (section)

====Unholy PAC attack====
This attack, discovered in mid-2016, exploits weaknesses in the [[Web Proxy Autodiscovery Protocol]] (WPAD) to expose the URL that a web user is attempting to reach via a TLS-enabled web link.<ref>{{cite web|last1=Goodin|first1=Dan|title=New attack bypasses HTTPS protection on Macs, Windows, and Linux|url=https://arstechnica.com/security/2016/07/new-attack-that-cripples-https-crypto-works-on-macs-windows-and-linux|website=Ars Technica|date=26 July 2016|publisher=Condé Nast|access-date=28 July 2016|url-status=live|archive-url=https://web.archive.org/web/20160727160434/http://arstechnica.com/security/2016/07/new-attack-that-cripples-https-crypto-works-on-macs-windows-and-linux|archive-date=27 July 2016}}</ref> Disclosure of a URL can violate a user's privacy, not only because of the website accessed, but also because URLs are sometimes used to authenticate users. Document sharing services, such as those offered by Google and Dropbox, also work by sending a user a security token that is included in the URL. An attacker who obtains such URLs may be able to gain full access to a victim's account or data.

The exploit works against almost all browsers and operating systems.