Did you notice that he was referring specifically to sites with accounts? There's little point in encrypting public data, especially if tracking cookies aren't

Did you notice that he was referring specifically to sites with accounts? There's little point in encrypting public data, especially if tracking cookies aren't involved.