Security Policies: Same-Origin Scripts on a Web page cannot access content or services from any host except the host that the script was loaded from. Hostnames are compared string-wise Why: Prevents stealing data from inside a firewall http://warp.mcom.com/client/index.html http://grey.mcom.com/docs/index.html http://grey/docs/index.html ftp://grey/tests/testplan.html http://homepage.mac.com/mstoltz/photos/index.html http://www.bbc.co.uk/films 4/25