Encrypt all the things!

They haven't actually broken encryption, they realised that computationally it would cost billions and take hundreds of year... why bother doing that when you could effectively hire spies to work inside Verisign, Microsoft, Oracle, Google, etc. Once your spies are embedded, you just steal the private keys used in the encryption frameworks.

It's far far cheaper than actually breaking encryption, and with the private keys you can decrypt virtually everything.

There are strong encryption tools that can prevent this. They use what is known as perfect forward secrecy: http://en.wikipedia.org/wiki/Perfect_forward_secrecy

Those things encrypt with a fresh privately generated key after the initial handshake, and so the NSA can't work around that by stealing keys.

But still... what difference does that make? As the NSA has these spies, and if we encrypt communication they will just ignore that and use the spies to access the storage layer at those companies.

Basically, it is possible to encrypt communication in a way that cannot be decrypted cheaply or efficiently. But very few people are doing this (Google is pretty much the only one).

Once you know that, the real question becomes: Do you trust the company holding your data?

If the company is substantial, it will likely have spies within it. If it's too small, they will likely have security holes. There's a sweet-spot of a medium sized company that could be trusted, but by that virtue it will become popular enough to be a large company and get their spies embedded.

It's a really shitty situation, but the simplest thing to do is carry on encrypting (it does work), and avoid storing data with US companies (most likely to have spies).