As society has crossed into the internet age from the early 1990s until now, computer security has went from an obscure, almost irrelevant topic to something that some knowledge of is or should be desirable for everyone. What would be thought of as paranoid 10 or 15 years ago is simply a good precaution these days.
While it shouldn't probably take an Einstein to work out where the trend is going, it is very likely to continue that way because of a few factors:
- There is money involved. People are making money (and lots of it!) from security breaches.
- Stupid and/or naive people. Because of this, the biggest security hole is usually found in meatspace, and can't really be patched.
- Features vs security; features make money now, security only pays off in the event of a breach.
- Due to factors 1-3, money will continue to be made from security breaches for the foreseeable future. Because money will be made, technology to breach security will continue to improve.
- Hardware and technological advances. GPUs, rainbow tables, specialized hardware, password crackers, you name it, it's either here or around the corner and has potential to make what was once secure, insecure.
- Google and a society of net savvy people. It is easy to research how to breach a given security measure, and if it exists it will probably be found.
An implication of the above is that it is often easier to go a bit overboard and design things to be very secure once, than have to review your security all the time. For example, even though xkcd pokes fun at 4096 bit RSA, it is now suggested to use more than 1024 bit. Since I started using 4096 bit RSA back in an era when 1024 was standard and googling 4096 bit RSA only yielded a link or two (I think it was 2004 or 2005), I don't have to change keys for those systems yet.
Another implication is that security by obscurity is probably only really useful in some forms of physical security, and not when your systems are readily examined. That is because the first step in a targeted attack is to research your target, and the next step is to research techniques to defeat the target (using Google). So you start thinking to yourself well, if I truly desire a good level of security I actually need to make it properly secure rather than just secure looking. And there can be a big difference in cost (time or money spent) between the two.
In order to make something properly secure, you have to analyze your defenses and brainstorm ways that they can be breached. This takes time. Also, if you are intelligent you will come up with an almost endless variety of methods for breaching a given defense. Implementing defenses takes time. Also, there are some serious downsides to some of the defenses. Ever encrypt a file and lose the key? You will understand what I'm talking about.
Looking at it like that, it is very tempting to take a "Nuke it from orbit" approach to security. Don't just shred papers in your trash, burn or compost them. Use Noscript and only whitelist sites if you trust them. Browse from a VM. Always use strong passwords. Never use the same email account, username or password on any internet forum. Don't confide in other people - they may burn you in the future. etc. etc. etc.
It is also easy to say that no one is interested in your data, or that if you have nothing to hide you have nothing to fear. That depends on who you are. Some people are going to be targets no matter what. A largish corporation is going to be a target. Wealthy people or their families will be targets. Having unpopular political views (even ones you no longer hold, or were popular at one time) might make you a target. Have an enemy or stalker? You are a target.
Some precautions are warranted. Some precautions may not be necessary. Sometimes it is hard to tell which is which, and to get your brain to shut off. So what do you do when your OCD combined with your interest in security causes a non-terminating loop of paranoia? It's easy to say "Look at the cost of implementing security measure vs cost of breach * probability of breach, but even doing that is way more than most people used to do and can consume a lot of time.
TL;DR: How do you balance the a tendency to want to secure everything to the point of paranoia, with some practicality? Are there some mental tricks that let you say "Whoa, stop, you are just wasting your time here."?
I think part of what may have made me start down a non-terminating loop is the idea that we should never take a risk if we can't live with the consequences. That statement can't be taken literally. If you take it to the logical conclusion, it means we can never travel anywhere. I guess you do have to have some sort of personal bar for making decisions, but I have yet to figure out a very quick heuristic for doing so.
Some things in life should also be 100% reliable/secure. For example, the button for launching a nuclear attack in response to a threat. If that button gets pushed, we are all toast. But if 100% security or reliability is impossible, what do we do in that situation? I pity the engineers charged with making the calls for things like that.