You keep coming back to the idea of sending unencrypted data over the general Internet. Of course it's not realistic to secure that.
I am more concerned with privacy violations where people do make reasonable efforts to keep their data/communications private, for example using encryption, but where those methods are then thwarted through abnormal means: untrustworthy infrastructure providers who give up root certificates, organisations with data centres the size of a small town having both access to vast quantities of data and the power to brute-force the decryption, government agencies holding you at an airport for hours under anti-terrorism laws and demanding all your passwords or very unpleasant things that would be illegal under normal conditions will be done to you, that kind of thing. (The last example is not intended to be a political statement, just an obvious topical example of how powerful organisations can circumvent otherwise competent encryption and thus breach otherwise private communications.)
[Edited to add:] The other big issue, IMHO, is whether people using services might think them to be reasonably private when in fact they are not. There's not much value in debating points like the ones I made above if the reality is that when Joe sends Jane an e-mail he erroneously believes it is already reasonably secure and private. This is, of course, primarily an issue of education and in particular of "honesty in advertising", rather than a technical failure, but it's still a big part of the problem today: why would people look for better solutions to a problem they don't realise exists?
Comments
I think we're talking at cross purposes here.
You keep coming back to the idea of sending unencrypted data over the general Internet. Of course it's not realistic to secure that.
I am more concerned with privacy violations where people do make reasonable efforts to keep their data/communications private, for example using encryption, but where those methods are then thwarted through abnormal means: untrustworthy infrastructure providers who give up root certificates, organisations with data centres the size of a small town having both access to vast quantities of data and the power to brute-force the decryption, government agencies holding you at an airport for hours under anti-terrorism laws and demanding all your passwords or very unpleasant things that would be illegal under normal conditions will be done to you, that kind of thing. (The last example is not intended to be a political statement, just an obvious topical example of how powerful organisations can circumvent otherwise competent encryption and thus breach otherwise private communications.)
[Edited to add:] The other big issue, IMHO, is whether people using services might think them to be reasonably private when in fact they are not. There's not much value in debating points like the ones I made above if the reality is that when Joe sends Jane an e-mail he erroneously believes it is already reasonably secure and private. This is, of course, primarily an issue of education and in particular of "honesty in advertising", rather than a technical failure, but it's still a big part of the problem today: why would people look for better solutions to a problem they don't realise exists?