Unhosted web applications: a new approach to freeing SaaS

These apps should be able to use both models. They can run entirely on the client side, talking only to encrypted data stores on the server; or they can talk to both traditional web apps/web services, as well as your own encrypted storage. Just like with email; you rely on your service provider to be online for you, accepting and queueing mail, but once you download it, you control the data, the program that works with it, and what you do with it.

What I'd really like to see is a good permission system for giving third-party services access to some of your data, in a reasonably fine-grained, and revokable fashion. That way, if you wanted to use a service that acquires value by being shared with others you could do so—say, a spam filtering service that learns to distinguish spam from ham on a large corpus, but limit it to read-only access of some of your mail folders, plus the ability to move mail to a spam folder. If you decide later on that it's no longer helpful, or you no longer trust it, you can revoke its access token, and it can no longer see any of your data.