0b3ada29_er_enabled_Cross_Site_Requests__Site_Communication_Mechanisms_Security_Considerations
[Description of Mechanism] postMessage for Cross-Window Messaging [Conforming User Agents] IE8 beta, Firefox 3, Opera 9.5, Safari (coming soon) Can only be used for scripts. Cannot be used for XBL, XSLT, SVG for cross-site loads of public data. See postMessage. [Security Considerations] 
Cookies and Auth (private data)can be sent with requests, and user is unaware that such requests are taking place Mashup Site has to open an iframe pointing to Data Site. Data Site can thus engage in misleading content (matching what's on Mashup Site, for example, so that domains are not distinguishable visually).
Browser-enabled Cross Site Requests
Security Considerations