ask yourself what you're actually protecting against. casual snooping? corporate espionage? government surveillance? each requires completely different approach