The layman's counter-argument I run in to for any complaint about inadequate security seems to always take the form:


  You don't need security if you aren't doing something illegal.


This kind of response is frustrating to say the least. In part because it's not constructive, but also because it's blatantly false.

How do you deal with these kinds of responses from people?

I'm looking for concrete examples that can be presented that show the need for strong security when conducting perfectly legitimate activities. Examples in the areas of trust worthy encryption on end-to-end communications for cellular networks, network identity obfuscation services like Tor or VPNs, complete and total data destruction, and so on are what I'm after.

I'm always inclined to point to social uprisings in states like Libya and Egypt but these events tend to be presented to too many of the people I encounter that use this argument as "things that happen on TV" and not real things that have any effect on them or their personal liberties. So counter-arguments that keep it squarely in the first world, it-could-hurt-you-or-your-grandma kind of are really valuable here.


  This question was IT Security Question of the Week.
  Read the Oct 10, 2011 blog entry for more details or submit your own Question of the Week.



  You don't need to lock your front door unless you're a thief.


It's the same idea in all relevant respects.

Each person needs to take reasonable measures to protect himself and his property from those who would harm him or his property, in accordance with his best judgment of the risks.

You buy a lock and lock your front door if you live in a city, in close proximity to hundreds of thousands of others. There is a reason for that. And it's the same reason why you lock your Internet front door.
