Earlier quoted context omitted.
I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly. It feels like a good compromise between privacy and speed.
If you’ve got a VPN, why not everything? You’re currently leaking a ton of data via DNS and HTTP certs, aren’t you? You are indeed protected against active content injection, but that’s rarely the problem with a for-pay ISP
Latency through the VPN is worse. It's not super-worse, but it is worse.
> You’re currently leaking a ton of data via DNS and HTTP certs, aren’t you?
I'm putting DNS through the VPN as well, so no.
But HTTPS certs - yes I am. It's a compromise.
> You are indeed protected against active content injection, but that’s rarely the problem with a for-pay ISP
This is literally one of the specific problems I was trying to avoid. My ISP is Comcast (the only choice where I live) and they routinely practice HTTP injection: https://gist.github.com/ryankearney/4146814
It's not just injection, though. With plain HTTP Comcast gets to see the contents of every page I visit, if they want to. And I do not want them to.