It's a common misconception that the purpose of security is used to provide privacy. I'll deal with that first, then we'll get on to the comment thread.

Information security can be about trust, i.e. I trust that person A sent this message because of X, y, z. I also trust that the message hasn't been tampered with because of X, y, z.

Privacy is a sub/side topic of information security. E.g. keeping all network connection data about an individual obfuscated at all times i.e. All data is kept hidden in a way that cannot be made unhidden.

Privacy is part of information security, and serves to ensure certain systems could be considered secure in certain cases (depends on the threat model/requirements of the system).

Basically, you've got it the wrong way around. Privacy (as a purely technical idea) exists to keep some information secure in certain cases.

Recent Fawkes paper is a good example of privacy as a security consideration.

Now for a case where it doesn't matter...

Whenever you're asked to run an MD5 hash check of a file you've just downloaded, that's an example of authentication/verification.

Doesn't matter if someone has seen that you've downloaded the file, just that the downloaded file is correct (for you).

Good example is Linux OS distribution ISOs.

Privacy doesn't really matter in that case (depending on your threat model), what matters is that the file you've downloaded matches what you wanted to downloaded. No-one intercepted and tampered with the data in transit.

You can trust the data that you've downloaded.

It doesn't matter if Mr FBI saw that I downloaded it, because it's not illegal. So why waste energy and resources on solving a problem that's not a problem?!

Now on to protection of confidential data...

Facebook is actually a good example of this. Most people are not anonymous on there. You can search and find people (depending on settings). Privacy, in that sense, is not provided.

However, they do (or are supposed to) keep our data protected from external malicious adversaries, whilst not making it completely private to everyone.

I can see my friends information, it is not private. It is, however, supposed to be protected and kept safe e.g. a credit card number.

A credit card number can't be completely obfuscated because then it can't be used. Instead, that personal information should be protected.

https://en.m.wikipedia.org/wiki/Information_security

Now, in relation to the parent of the parent of the.....

The point of the comment, and I agreed with it, is that if personal information is leaked to the public -- that's not privacy, it is improper confidential data access -- really bad things can happen.

I can call that number every 2 minutes to perform a denial of service attack (eventually they'll turn their phone off, no more phone service!).

I could send horrific child porn to that number.

I could do X, y, z with a phone number.

I don't need passwords and encryption keys or zero day access to your hardened Linux box to fuck up your life.

I can do it with a phone number.

And here's the real kicker --- I don't even know who this person is! They're anonymous to me. Their privacy is mostly intact, but I've got access to confidential information which means I can fuck up their life regardless.

So your point of "well, why don't they just give out access to ALL the confidential information" was, actually, kind of on point!

That's exactly the kind of data we definitely do not want out in the wild. That's extremely sensitive data with which I could cause absolute havoc!

Where you fell down was the "leak all of it cos why not". One tiny piece of leaked confidential data can be massively dangerous. That was the point of the comment.

One tiny piece of data and I can ruin your life. I don't need everything, just one thing. One phone number.

Hopefully that was helpful. It's all a shade of grey depending on your threat model tbh.