Sandy Kemsley followed the news on the Yahoo email worm and found out that:
As alarming as this might sound, think about the timeline for a minute. Late Monday morning, the problem hits the news. Early Tuesday afternoon, the security hole is fixed; because there’s no software installed on any desktops, the fix is effectively distributed everywhere instantaneously. By late Tuesday afternoon, they’re already into the post-game analysis since there’s nothing else to talk about.
If the browser is your operating system, security fixes are one less thing to worry about.
As Barry Briggs points out in a discussion about Google Spreadsheet over at IT|Redux(*):
Worse, the prospect that a host will index your data and keep that index around for its own purposes should scare all of us.
So look at the benefits: your data is backed up and safe, it’s an end to installation hell, and security flaws are quickly patched up. Say good bye to viruses.
Now look at the drawback: your data may be accessible to other people. And ask your SaaS vendor to start encrypting it.
Fortunately, it’s not that hard to add.
(*) If you’re not already reading IT|Redux, head over here and subscribe.