Indistinguishability by Default