I'd put it more simply: "Users don't care about privacy or security." I put it in quotes because it's become a kind of catch phrase, and in practice I have fo

I'd put it more simply: "Users don't care about privacy or security." I put it in quotes because it's become a kind of catch phrase, and in practice I have found this to be largely correct. We've tried very hard to make our product secure, but users almost never ask about that. We have never been asked about the quality of our crypto by a regular user, and only once by an enterprise user. Users care about UX and cost, in roughly that order, and little else. This is even true of most enterprise users. This is why security sucks. This is why everything spies on you. It's not a priority for anyone because it doesn't affect user buying behavior. The tiny minority who do care are not only too small to matter but also tend to be the kinds of "hackers" who like to DIY (and pirate) rather than buy things... making them doubly economically insignificant. In the end the privacy issues around things like this will have to be fixed with legislation. We will need to effectively extend HIPAA regulations to cover all kinds of other personal data: passively recorded audio and video, location tracking data, anything more than the most superficial user logging, etc. Vendors will face a fine of $$$ per incident if this information is leaked, and sale and use of information will be strictly regulated. As far as government surveillance goes: that horse left the barn over a decade ago, and that also can only be fixed in the legislature. The legislature must regulate intelligence agencies and police. If they don't, no amount of techno-fixing will limit the power of these agencies. They have larger budgets than you.