[bradknowles]

Some carriers are doing deep packet inspection and using transparent proxies loaded up with certs from shady providers that let them see inside all HTTPS traffic. Even if they’re not looking inside the HTTPS traffic, they can see where you are going and shape your traffic down, if they don’t want you to get good video performance from NetFlix, since that would be a competitor to their zero-rated video service.

AT&T is certainly doing traffic shaping on a lot of sites. I get much better video performance from NetFlix, YouTube, and a variety of other websites, when I am on VPN.

AT&T is also known for doing a lot of DPI on non-HTTPS connections, and inserting their own intrusive ads. I’m not sure whether they’re doing the super shady transparent proxy of HTTPS traffic, but I would not be at all surprised. I mean, someone had to be paying Symantec all that money for those certs.

So, yeah — I don’t trust my carrier at all. I need to be on VPN all the time, and I’d prefer to do that with a reliable load balanced upstream configuration, but the questions over SD-WAN are going to have to be for a different thread.

[themarkers]

that's a nice catch