Web-based cryptography is always snake oil