The web can be weaponised – and we can't count on big tech to stop it