> note I don't have their paper) they say they don't need any heightened > Java privileges. What's a little confusing here is exactly how > they are getting

> note I don't have their paper) they say they don't need any heightened > Java privileges. What's a little confusing here is exactly how > they are getting past same-origin issues. They don't need same-origin. Juliano confirmed this to me a couple of days ago. And the leaked paper shows how they do it. http://news.ycombinator.com/item?id=3032278 http://news.ycombinator.com/item?id=3032278 Edit: Either I got copy-paste fat fingers or he changed the blog post; but I did copy that part from somewhere...