title: How does Google get around the cross-site font-usage security in Firefox with their new Webfonts service?
body: <p>Google offers webfonts - <a href="http://code.google.com/webfonts" rel="nofollow">http://code.google.com/webfonts</a></p>
  
  <p>They work in Firefox, but FF has a security policy to stop cross-site font usage - <a href="http://hacks.mozilla.org/2009/06/beautiful-fonts-with-font-face/" rel="nofollow">http://hacks.mozilla.org/2009/06/beautiful-fonts-with-font-face/</a> (search for Cross-Site Font Usage). </p>
  
  <p>Can anyone hazard a guess how they do this? Do they use 'access control headers'? Is there a way to test for it? </p>
  
  <p>And are there any security concerns with adding access control headers?</p>
  
  <p>Thanks in advance.</p>