Privacy risks of signed Java applets

Probably it is an occupational hazard, but when I've listened to episode #222 of the Java Posse (1/3 of the devil :-D) and they talked about a java applet do do screencasts, my first reaction was: is it possible to do this from an applet? isn't this a privacy risk?

The answer is: it depends :-). It relatively easy to capture a screen, however you need the applet to be signed for it to be able to do this. And if you've allowed a signed applet to run, you (potentially) have bigger security issues (like the applet accessing arbitrary files on the harddrive).

In conclusion: it is nice to see that Sun thought of this potential problem. Then again, this is an other example which illustrates that an "all-or-nothing" security policy is not perfect (what if the user wants to give screen capture access but not access to files? s/he can edit the java policy file, but that is beyond the knowledge of most users), but also that more fine-grained solutions - like the .NET Code Access Security - are too complicated (both for users and developers) and the end result is that they are not used at all.