Once you start throwing around terms like "basic infosec", I think you need to recognize that the vast majority of people in the world won't even know what that term means. And shouldn't have to. It's up to us (the more technically-minded people) to protect them by helping to drive change, both in legislation, and technical measures to make it so people don't need to trust these big corporations. That's our failure, though I certainly recognize that this is a difficult thing to do.

> Why keep blaming big corporations when we need to get smarter ourselves?

Why do we pretend that a practical answer to anything is "well people should stop behaving like people" ?

Systems should be designed to work with people as they actually behave, not an idealized version.

Why not both? Blame the corporations, sue the heck out of them, but then also make good infosec more widespread.