Online security for journalists: Never assume you’re secure