input: [Description of Mechanism] Using Flash and crossdomain.xml [Conforming User Agents] All (with latest version of Flash; or J2SE; or Silverlight) Flash is discussed here because of ubiquity. Flash tyically reuses browser's HTTP stack (limitations of NPAPI). See Flash. [Security Considerations] 
output: Cookies and Auth (private data) can be sent with requests, and user is unaware that such requests are taking place Risk that Data Site will opt in on URLs which serves user-private data without realizing that URL will leak private data Risks with "*" on policies per domain. Understood risks with file-based policy languages for site access Flash provides further capabilities outside of this discussion's scope.