46

Many people have heard about third-party cookies, and some browsers even block those by default. Some people may even be using Private Browsing modes. However, only few seem to realise that Adobe's Flash player also leaves a cross-browser trail on your local hard drive, and allows for sending cookie-like information back to the server, including third-party sites. And because it is a plugin, Flash does not take any of the browser's privacy settings into account.

Sorry for the long post, but first some details about why using Flash raises a privacy concern, followed by the results of my tests:

  • The Flash player keeps a cross-browser history of the domain names of the Flash-sites your computer has visited. Unlike your browser's history, this history is not limited to a certain number of days. History is also recorded while using so-called Private Browsing modes. It is stored on your hard drive (though, as described below, without going to Adobe's site you won't know what is stored).
  • I am not sure if any date and time information is kept about each visit, but to see the domain names: right-click on some Flash content, open the settings dialog, and click the Help icon or click the Advanced button within the Privacy tab. This opens a browser to the help pages on Adobe.com, where one can click through to the Website Storage Settings panel.
  • One can clear the existing list, but one cannot stop it from being recorded again.
  • Flash allows for storing data on your local hard drive, using so-called Local Shared Objects (aka "Flash Cookies"). Just like HTTP cookies, this data can be sent back to the server, for tracking purposes. They are cross-browser, have no expiration date, and no user defined maximum lifetime can be set in the Flash preferences either. These not being HTTP cookies, they are (of course) not blocked by a browser's cookies preferences and are not removed when the normal HTTP cookies are deleted. Adobe has announced that version 10.1 will obey Private Browsing in most popular browsers, but unfortunately no word about also removing the data whenever normal cookies are deleted manually. And its implementation might be confusing:

    [..] if the browser is in normal browsing mode when the Flash Player instance is created, then that particular instance will forever be in normal browsing mode (private browsing is turned off). Accordingly, toggling private browsing on or off without refreshing the page or closing the private browsing window will not impact Flash Player.

  • Local Shared Objects are not limited to the site you visit, and third-party storage is enabled by default. At the Global Storage Settings panel one can deselect the default Allow third-party Flash content to store data on your computer. Because of the cross-browser and expiration-less nature (and the fact that few people know about it), I feel that the cross-browser third-party Flash Cookies are more dangerous for visitor tracking than third-party normal HTTP cookies. They are even used to restore plain HTTP cookies that the user tried to delete:

    "All advertisers, websites and networks use cookies for targeted advertising, but cookies are under attack. According to current research they are being erased by 40% of users creating serious problems," says Mookie Tenembaum, founder of United Virtualities. "From simple frequency capping to the more sophisticated behavioral targeting, cookies are an essential part of any online ad campaign. PIE ["Persistent Identification Element"] will give publishers and third-party providers a persistent backup to cookies effectively rendering them unassailable", adds Tenembaum.

    [..] To justify this tracking mechanism, UV's Tenembaum said, "The user is not proficient enough in technology to know if the cookie is good or bad, or how it works."

  • When selecting None (zero KB) for Specify the amount of disk space that website websites that you haven't yet visited can use to store information on your computer, and checking Never ask again then some sites do not work. However, the same site might work when setting it to None but without selecting Never ask again, and then choose Deny whenever prompted. Both options would result in zero KB of data being allowed, but the behaviour differs.
  • The plugin also provides a Flash Player cache for Adobe-signed files. I guess these files are not an issue.

So: how to automatically delete that information?

On a Mac, one can find a settings.sol file and a folder for each visited Flash-website in:

$HOME/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer/sys/

Deleting the settings.sol file and all the folders in sys, removes the trail from the settings panels. However, the actual Local Shared Ojects are elsewhere (see Wikipedia for locations on other operating systems), in a randomly named subfolder of:

$HOME/Library/Preferences/Macromedia/Flash Player/#SharedObjects

But then: how to remove this automatically? Simply removing the folders and the settings.sol file every now and then (like by using launchd or Windows' Task Scheduler) may interfere with active browsers. Or is it safe to assume that, given the cross-browser nature, the plugin would not care if things are removed while it is active? Only clearing during log-off may not work for those who hibernate all the time.

Firefox users can install BetterPrivacy or Objection to delete the Local Shared Objects (for all others browsers as well). I don't know if that also deletes the trail of website domain names.

Or: how to stop Flash from storing a history trail?

Change of plans: I'm currently testing prohibiting Flash to write to its own sys and #SharedObjects folders. So far, Flash has not tried to restore permissions (though, when deleting the folders, Flash will of course recreate them). I've not encountered any problems but this may take some while to validate, using multiple browsers and sites. I've not yet found a log that reports errors. On a Mac:

cd "$HOME/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer"
rm -r sys/*
chmod u-w sys

cd "$HOME/Library/Preferences/Macromedia/Flash Player"
# preserve the randomly named subfolders (only preserving the latest would suffice; see below)
rm -r \#SharedObjects/*/*
chmod -R u-w \#SharedObjects

I guess the above chmods cannot be achieved on an old Windows system (I'm not sure about XP and Vista?). Though maybe on Windows one could replace the folders sys and #SharedObjects with dummy files with the same names? Anyone?

Obviously, keeping Flash from storing those Local Shared Objects for all sites may cause problems. Some test results (Flash 10 on Mac OS X):

  • When blocking the sys folder (even when leaving the #SharedObjects folder writable) then YouTube won't remember your volume settings while viewing multiple videos. Temporarily allowing write access to the blocked folders while visiting trusted sites (to only create folders for domains you like, maybe including references in settings.sol) solves that. This way, for YouTube, Flash could be allowed to write to sys/#s.ytimg.com and #SharedObjects/s.ytimg.com, while Flash could not create new folders for other domains. One may also need to make settings.sol read-only afterwards, or delete it again.
  • When blocking both the sys and #SharedObjects folders, YouTube and Vimeo work fine (though they might not remember any settings). However, Bits on the Run refuses to even show the video player. This is solved by temporarily unblocking the #SharedObjects folder, to allow Flash to create a subfolder with some random name. Within this folder, it would create yet another folder for the current Flash website (content.bitsontherun.com). Removing that website-specific folder, and blocking both #SharedObjects and the randomly named subfolder, still seems to allow Bits on the Run to operate, even though it still cannot write anything to disk. So: the existence of the randomly named subfolder (even when write protected) is important for some sites.
  • When I first found the #SharedObjects folder, it held many subfolders with random names, some created on the very same day. I wonder when Flash decides it wants a new folder, and how it determines (and remembers) that random name.
  • For a moment I considered not blocking write access for sys and #SharedObjects, but explicitly creating read-only folders for well-known third-party tracking domains (like based on a list from, for example, AdBlock Plus). That way, any other domain could still create Local Shared Objects. But the list would be long, and the domains from AdBlock Plus are probably all third-party domains anyway, so disabling Allow third-party Flash content to store data on your computer might have the very same result.

Any experience anyone?

(Final notes: if the above links to the settings panels do not work in the future, then use the URL that is known to Flash player as a starting point: www.adobe.com/go/settingsmanager. See also "You Deleted Your Cookies? Think Again" at Wired.com -- which uses Flash cookies itself as well... For the very suspicious using Time Machine: you may want to exclude both folders, for each user, and remove the trace that is already on your backup.)

6
  • 14
    I've considered this issue a serious browser design flaw since I first encountered it. The ideal solution would be for web browser plug-in interfaces to either be extended so the browser could tell all plug-ins to clear their respective caches, or require plug-ins to place their caches in a folder the browser can purge when it wants to. Until browser developers solve this problem for us, though, your question is very relevant. Jul 16, 2009 at 13:42
  • And I guess an interim solution could be a simple warning when changing cookie or history settings, or when starting some Private Browsing mode. But above all I blame Adobe for that default of allowing third-party storage.
    – Arjan
    Jul 16, 2009 at 17:11
  • Hmmm, something I need to look into one day: YouTube's delayed cookies -- not related to Flash, unless those are Flash cookies as well. google.com/support/youtube/bin/answer.py?answer=141046
    – Arjan
    Aug 4, 2009 at 11:01
  • See also "Flash Cookies and Privacy" at papers.ssrn.com/sol3/papers.cfm?abstract_id=1446862, with its abstract: We find that more than 50% of the sites in our sample are using flash cookies to store information about the user. Some are using it to 'respawn' or re-instantiate HTTP cookies deleted by the user. Flash cookies often share the same values as HTTP cookies, and are even used on government websites to assign unique values to users. Privacy policies rarely disclose the presence of Flash cookies, and user controls for effectuating privacy preferences are lacking.
    – Arjan
    Feb 15, 2010 at 15:30
  • 2
    Adobe is learning: from January 2011's On Improving Privacy: Managing Local Storage in Flash Player: Representatives from several key companies, including Adobe, Mozilla and Google have been working together to define a new browser API (NPAPI ClearSiteData) for clearing local data, which was approved for implementation on January 5, 2011. Any browser that implements the API will be able to clear local storage for any plugin that also implements the API.
    – Arjan
    Jan 26, 2011 at 19:07

5 Answers 5

5
+150

I implemented the solution you described on Mac a few months ago. It did prevent the tracking, but it prevented quite a few more complicated Flash applications (anything with persistence between sessions, most obviously Flash games with progress tracking) from operating correctly, or at all. Eventually I got tired of troubleshooting and removed the folder locks.

My interim solution is using a Flash blocker. As I only load Flash objects for sites I trust (such as YouTube) the privacy concerns are mitigated, if not removed.

5
  • When you responded, my question only mentioned the sys folder. Meanwhile, Wikipedia has helped me find a #SharedObjects folder as well. Which folder did you block?
    – Arjan
    Jul 20, 2009 at 16:49
  • I think it was ~/Library/Preferences/Macromedia/Flash\ Player that I locked. That prevented writing to both 'sys' and '#SharedObjects' but it wasn't very subtle!
    – redacted
    Jul 21, 2009 at 8:22
  • Which Flash Blocker do you use?
    – alex
    Sep 24, 2009 at 23:38
  • @alex - rentzsch.github.com/clicktoflash works perfectly for Safari/Webkit. No hacks required!
    – redacted
    Sep 26, 2009 at 22:01
  • I second @redacted's suggestion (ClickToFlash) -- works fantastically.
    – Alex
    Mar 14, 2010 at 1:45
12

If you use Firefox then you have the BetterPrivacy extension. It removes LSOs during exit. And of course you can use Flashblock or NoScript for additional security.

Update: Since 10.1 Flash doesn't store LSOs if you're in private browsing mode.

4
  • Love BetterPrivacy. Install and forget.
    – Travis
    Jul 21, 2009 at 14:57
  • Incorrect Update. It does not store 3rd party LSO's. It's really a quite despicable piece of software.
    – chiggsy
    Jul 17, 2011 at 0:46
  • @chiggsy, I cannot confirm that it's only denying 3rd party LSOs in privacy modes. I tested with Flash 11.0.1.152 in the latest Safari and Chrome on OS X Lion. Yes, whatever is stored is available during the same session (but not in other browsers). But the data does not seem to be stored on disk. I've not tested if Adobe's earlier statement is still true: [..] toggling private browsing on or off without refreshing the page or closing the private browsing window will not impact Flash Player.
    – Arjan
    Nov 6, 2011 at 11:36
  • As for BetterPrivacy, it does not only support cleaning on exit (which I rarely ever do with my browsers), but also: [...] or by a configurable timer function while certain desired Flash cookies can be excluded from automatic deletion.
    – Arjan
    Nov 6, 2011 at 11:44
3

I think on Windows CCleaner will clear it out.

1
  • 1
    Indeed, it does, though I could not easily find that info on www.ccleaner.com -- but your're right, it's in the change logs at ccleaner.com/download/version-history (which are a bit odd, as support to clean up Flash Player seems to have been added in multiple releases...?)
    – Arjan
    Jul 16, 2009 at 16:42
2

I've created a Mac OS X launchd script that continuously deletes your flash cookies.

Just change REPLACEME with your user name and save this file under ~/Library/LaunchAgents/RemoveFlashCookies.plist. Restart to load the script.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>  
    <key>Label</key>
    <string>Remove Flash Cookies</string>
    <key>ProgramArguments</key>
    <array> 
        <string>rm</string>
        <string>-rf</string>
        <string>/Users/REPLACEME/Library/Preferences/Macromedia</string>
    </array>
    <key>OnDemand</key>
    <false/>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>
1
  • I think the WatchPaths key to launchd would help a lot here. Instead of busy loop, just trigger the job when the path gets updated.
    – chiggsy
    Jul 17, 2011 at 0:44
1

Just an idea:

Try using:

hdiutil -shadow   # lots more besides this, I just thought of  it.

and mounting the paths as read only. Let Flash write to the shadow file, and maintain a known state of that directory. I am going to try the same thing with TopSites and that database of web page pictures that Safari takes.

Why?

Because I don't want to erase the data. I wish to send them back modified data. That way I can play in this data mining game too.

1
  • Only today I saw your post! Did you indeed implement this? Any fun details to share?
    – Arjan
    Apr 13, 2012 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .