What is the origin security for in a canvas?

I just read that if you load an image served from a different origin in a canvas you can see it but if you try, for instance, to access the imageData of that image, it is raising a SECURITY_EXCEPTION.

I get that,开发者_开发技巧 I just having hard times finding the reason for that. Do you guys have some example on why there is such a restriction like this one?

---

Imagine you have uploaded some personal photos to a private photo storage service - now imagine that private photo storage service has adverts that use the canvas element. If there's no origin restriction and I want to steal all your private photos, all I need to do is buy advertising space on the site, then use drawImage() to grab your photo then send the results of toDataURL() back in an AJAX request.