I am not a Web programmer, so what I suggest might be nonsense. Please correct constructively :) The central statement seems to be: > “Our implementation of t

I am not a Web programmer, so what I suggest might be nonsense. Please correct constructively :) The central statement seems to be: > “Our implementation of the Same Origin Policy allows every file:// URL to get access to files in the same folder and subfolders.” What about the following simple mitigations: * Access by file:// URL to the root and user's home directory proper are forbidden by the browser implementation (Because all subdirectories of the home directory is always a bad idea, root even worse so) Hard-coded, error dialog, period, no way to override short of patching the browser or mounting trickeries. * Access to any other subdirectories is allowed, but will cause a warning that by proceeding you grant access to the directory and all it's subdirectories. The warning cannot be suppressed by normal settings, but appears only once a day. An average user will not get it frequently, so there is a chance that they read it (and if they click OK without reading it's their problem). And for the Web developer clicking once per day is still easier than configuring an Apache. And ideally they know why they are clicking it.