[matthewdgreen]

Really they can both be true. They're just true for different constituencies. The vast majority of users are not targeted by active attacks, nor should they have reason to be. They may be hacked or subpoenaed after the fact.

[antihero]

I thought that "active" attacks is exactly what we were trying to guard against?