Yes, perhaps. But because Facebook's business model, and its incredibly bad technology, means that there's only one kind of friend, people who have been building networks of "friends" in law firms by accepting or initiating contacts inside law firms have also put all their personal lives inside those law firms, even if only their "friends" can see it. (There's no architectural reason why social sharing has to be designed that way, but Facebook offers an outstandingly bad implementation.) So there's plenty of opportunity for informal diffusion of information into unintended locales even if people know how to manage what little residual control Facebook allows them.

Identity theft is not a retail matter. Credit card numbers, SS#s, maiden names and all the other relevant data allowing fraudulent purchases or (until lately) the initiation of fraudulent loans are circulated in buckets of thousands or tens of thousands, not units, having been stolen from places where one breach yields the whole database, not photographs of someone using a beer bong. Retail intrusion such as you are imagining people could protect themselves against by changing privacy settings (which is puerile, because a real attempt against a person will involve simply hacking the Facebook account by stealing the target's almost certainly non-random Facebook password) has a direct motive behind it, and will not be deterred in the slightest by the sort of trivial "protection" Facebook affords. Putting things you wouldn't want your most motivated and most destructive enemy to know in someone else's commercially-managed, ill-secured database is a recipe for disaster unless your worst enemy is a technically-illiterate eight-year-old who spends all her time in church.

Which is true because they are carefully not educated in what the threats are, which is in turn true because money and power don't want them to understand what the threats are because money means to make money, and power means to make power, out of their ignorance. Your essay, so far, does nothing whatever to disturb that process of embedding ignorance, because you haven't described for the reader what the threats actually are or what to do about them. That you can fancy you are writing seriously about privacy threats and responses while implying that Facebook-using is consonant with even minimal respect for privacy is demonstrative.

The danger is not as tangible as that of writing one’s name and social security number on a sheet of paper and taping it to a lamp post,

It's much more tangible. The lamppost is visible only to people who happen to be close enough to read what's on it. The data you put carelessly on the net is visible to everyone on earth.

and it is certainly not as real as a thief breaking into one’s house and taking confidential files.

Burglary is hard and risky. Data-stealing is easy and almost entirely riskless.

Instead, for most of us we learn of online privacy dangers through warnings from the media and anecdotes from friends. This creates an almost mythical kind of fear, an amorphous fear that is always lurking, but one that can be dismissed as easily as it can be sensationalized. As a result, like the myriads of ways in which children react to ghost stories, people respond to the online privacy threat in ways that reflect their “gut feeling” rather than any reasoned process of thought.

So you should be providing a clear understanding of the actual threats and what to do about them. I explained both in class, and here you are obfuscating them again.

But you're not informing anybody, are you?

They get it from the one big ill-secured database run for the purpose of spying on you that you voluntarily decided to put all your social data in for no good reason. The right response is to move your social data out of that big unsecured centralized database.

By understanding the mechanisms through which a person’s information could be pilfered, one is better able to take reasonable precautions instead of resorting to extreme measures. Paranoid behavior comes from hearing sound bites such as “you leave a track of everything you do online” without attempting to really understand such statements. In the Facebook/EIP example above, if those who deactivated their profiles took time to think through the absurdity of law firms using the students’ friends to spy on their profiles, then perhaps they would simply have “privatized” their profiles instead of temporarily deactivating their account.

But that would be ignorance, and you're recommending it.

My response to the first draft was that you needed a more ambitious theme, not a less informative and more obscurantist one. A naive reader facing this draft would know nothing helpful she didn't know before reading it. A knowledgeable reader could only conclude either that you are yourself ignorant or that you are deliberately white-washing Facebook. Either way, the knowledgeable reader, like the naive one, has gained nothing.

I still think what you need here is more ambition. If this is the topic, then the ambition should be to learn more facts and imagine fewer ones. In my own view, this "in the middle-ism" between what you think of as paranoia (and which isn't even moderate concern for privacy, just cluelessness) and utter heedlessness is a poorly-chosen vantage. You should be speaking from actual expertise about something you fully understand because you have learned about it in detail. I taught a course meant to enable such a vantage for you, but perhaps I did it poorly. If you want to talk more about the matter, let's make an appointment.