<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
> Date: Wed, 17 Feb 2010 11:18:03 -0800<br>> From: mogulguy@yahoo.com<br>> Subject: Re: Access from a local file<br>> To: or-talk@freehaven.net<br>> One of the reasons is to prevent malicious users from including file:// urls in an external webpage. With file:// urls, a webpage could be designed to test for the existence of local files on your computer. <br><br>How? Same origin policy prevents an external website from accessing any local files directly. And the 'onload' trick detailed at<br>http://72.32.12.210/archives/vulnwatch/2002-q2/0032.html<br>doesn't work (FF2 OSX anyway) because the images or Iframes never load from local resources at all.<br>Do you have a Proof of Concept?<br><br>GD<br> <br /><hr />Hotmail: Trusted email with powerful SPAM protection. <a href='http://clk.atdmt.com/GBL/go/201469227/direct/01/' target='_new'>Sign up now.</a></body>
</html>