There’s been a discussion at the Domain Driven Design group about how to restrict access to certain data in the domain without using DTOs. Sergio Bossa has a blogentry on it here on how to restrict access with proxies. It’s a good solution if you need to restrict access locally, but if your need is to transfer objects remotely you are right back at using DTOs.
Oh yeah, and discovered Dozer for doing object-to-object mappings.