The proliferation of mashup sites could present a major security threat, warned some participants at last month's Computer-Human Interaction conference in Montreal, Canada. Mashups, or Web applications that combine information from two or more sites, are often hastily thrown together with no guarantees of accuracy, and privacy and security concerns are sometimes just an afterthought. Mashups have become very popular for the local information they provide--neighborhood crime data overlaid on a Google map, for instance--but there is nothing to stop people from using them to collect addresses or other sensitive identifying information. Mashups have appeared that help commuters monitor traffic and travelers map their journeys, and new mashup sites are appearing at the rate of 10 a week. Google, Microsoft, and Yahoo! have all made the application programming interface (API) of their mapping sites freely available, recognizing that mashup sites help broaden the footprint of their service. But mashup creators do not take the precautions to address concerns such as data integrity, system security, and privacy, according to Hart Rossman of Science Applications International. "How do you know the data is real?" Rossman asks. The owners of the sites from which mashup creators pull their data neither know nor care that their information is being used, and the absence of encrypted ID certificates in the exchange between the mashup creator and the source invites the possibility that the data could be coming from a spoofed site, Rossman warns. Mashup sites also do not have rules governing how people's personal information can be used, and viruses could be specifically written to attack mashup sites. A mashup worm could follow the data back to its origin and corrupt its contents, says Rossman. The mounting security concerns come as some mashups, particularly in the travel sector, are growing into huge, multi-million-dollar ventures that play an increasingly important role in people's daily lives.
 Click Here to View Full Article