1) Multiple-encryption VPN over TOR, with non-tracking search engines.
2) True, but someone else finding it and tracking it back to you can be made near impossible.
3) Not true. Sure, any encryption can be brute-forced cracked with enough power and time, but the cost would be prohibitive. If I write a good encrypting algorithm, I can assure you I'll never be able to decrypt any data encrypted with it unless I have the key, which only the data owner knows.
4) Sure, but the random-seeming collection of bytes won't mean anything to them.

Privacy online is certainly gone for any user who doesn't know how to really protect himself, or doesn't want to--which means most of them.