Steps You Can Take Right Now Against Internet Surveillance

Having everyone use SSL is better than nothing (and provides some amount of herd immunity to those that need to hide their communication). Two factor auth protects against a number of threat classes, such as the "local criminal" they mention. People might not care about the NSA, but there are plenty of other reasons to care about security.

Right before the list they state that these only provide incremential improvements. The last step might lead people to prism-break at some point (eg. during crypto parties).

In fact I'd argue that 2-factor authentication actually helps governments and private Internet companies because we willingly associate our mobile phones to our Internet accounts.

The best helmet, is the helmet you will wear

The rms approach, while effective, is untenable for most people. Sometimes more moderate livable recommendations will wind up doing more good, because people will wear them.

Yes, I was surprised by this too. Giving away your mobile phone number is not something I'd consider doing lightly. What's more, Google have a poor record on privacy matters.

If you provide your phone number to Google, who has access to this info at the company? Is your phone number encrypted so that no-one sees it at Google? i.e is it only accessed by automated computer systems? Do they have strict procedures in place that allow access to authorised staff under particular circumstances only? Do they tie your number to other tracking info? (Of course, Google would never reveal this, but it wouldn't surprise me if they did).

I think these are perfectly legitimate questions to ask when a company stores your personal information. And particularly for a company that has greater oversight of online activity than anyone else. We don't know the answers to any of these questions, because Google's vaguely-worded privacy statements tell you nothing. (The help text when signing up to a Gmail account simply states "your phone helps with keeping your account secure...")

You might feel you can trust Google on matters of security, but can you trust them on matters of privacy?

Of course, one should use 2FA whenever available, but it has nothing to do with avoiding surveillance. Indeed, it creates a stronger link between an account and an identity, i.e. anonymous twitter account + 2FA w/ mobile phone number == not anonymous.

The major vulnerabilities sound like details of implementation alone. Then there is a difference between the more easily lost privacy and the less easily lost anonymity.

Finally, people who are actual experts seem to think it remains a tool for anonymity, and explain why in a credible way.

But other than that, Tor is by far the best thing for your privacy right now.