Online travel company Travelocity has been criticised by security experts after making personal details of site users visible on its site.

In a grovelling apology issued to the press, Travelocity said that names and addresses of people who had entered some of its competitions had been "inadvertently made accessible" through a link on the site.

Security experts have criticised the company for bad security practice. Paul Rogers, a network security analyst at MIS, said that it was a very basic error, but one that happens quite frequently.

"Information from forms should be stored outside the web root," he said. "For a company that has implemented a security structure it is a surprising mistake to make, but power is nothing without control and security is nothing without common sense."

Neil Barrett, technical director at Information Risk Management, echoes his sentiments. He commented: "They could have ten times the firewall protection they have and still cock up the arrangement of content on the site."

Travelocity said that the mistake had served as a wake up call about the protection of its members' privacy: "We regret this incident occurred. We take the privacy of those who participate on our site, whether they are members, contest participants or visitors, very seriously." ®