I’m A Super.com

No doubt this can be abused and I don’t really have good solution for it, however this “large cookie” does serve a purpose and it has some great uses. You can use it as a mini database and cache locally on the client without making expensive service calls. Just like anything it can/will be abused by the people that want your info.

I’ve been involved with developing sites for oh, about 10 years now… this is the first i’ve seen of the Flash cookies nonsense. Just deleted a whole whack of them. I didn’t delete them through the flash utility though. If you have enough know-how you can hunt down the data in -application data- which is located in your user profile on most systems (microsoft stuff). If you can get that far, there is just tons and tons of this crap laying around. I believe they are called .sol files. Funny that extension, sounds a lot like s–t out of luck.

There’s no reason we should have to rely on Adobe to get rid of this nonsense. Totally unacceptable security risk. Which, I admit, I did not even know about until now. I have to start doing more development in Flash. This is crazy.

Hell I’ve been doing web development for 8 months now…

funny though that the “setting manager” does not delete the stuff in the second row of Jims script

“by default” it enables average users to use nifty adobe player functionality. (my pizza store, by default now remembers me and the last time i was there! wicked!
You can also choose max disk space for these cookies, you can also easily delete them, and you can easily stop them from being saved.

I agree the access to this information isn’t “easy”. but this is far from being a security problem.
I had to go through just as much clicks to get to my firefox cookie, as to get to the flash cookies. They also store only information they request. Which in some casses means saved games files (for flash games), and even pre-loaded code so that loads are faster.

This article, with its hefty boldening of sentences, makes this out to be an OMG! situation, when it’s not. Just as firefox, by DEFAULT, enables cookies and javascript code. Why can’t flash? This panel can also be accessed when using almost ANY flash application, through the right click context menu. Seriously, this feels like very little investigation of comparison. American style scare-mongering at it’s finest IMHO.

“Store 100 kb of data by default, with an unlimited max” - Wrong. 100kb is the default max. If it needs more it need to ask you for permission.
“Couldn’t be deleted by your browser” - Your wording is trying to imply that one can’t download it. They can, as you’ve shown.
“Send previous visit information and history, by default, without your permission” - It *stores* information rather then sending it somewhere else. Also it’s not like every site will have access to all your data; they’re restricted to the website, like cookies.

Yes, there’s a migration from cookies to Flash SO - simply because many times it’s much easier to manage and less prone to injection by malicious JS code.

But most importantly, all in all, they work pretty much the same as cookies and this kind of subjective analysis isn’t doing anyone any favor. I see what you’re trying to do - trolls will be trolls when there’s something to be gained by clicks both from people who agree and from enraged apologists (and you have ads in this very website to feed). But in the future, if you’re in any way interested in doing an analysis on a piece of technology, leaving your bias outside would be great.

And why the hell are you referring to a company that ceased to exist years ago? Inform much?

cleartext is the future

Mac users - need the Settings Manager at the click of a mouse? Open http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager06.html in Safari and create a webclipping dashboard widget.

And this invades your privacy how? A web site can store local data on your machine and access it next time, so what? Other sites cannot read this information, since the Flash Player’s “sandbox” won’t allow it. So at best a site can just track your movements during your visits to itself.

There’s countless other ways to do this that don’t involve cookies, flash, or JavaScript. A simple unique ID in the URL can be added and passed between pages on the site to track movement, and on the server they can store much more than a mere 100k worth of data tied to that ID.

What is the problem here? Flash maintains some local information that the flash application loads in. You can only access the Local Shared Object if you are accessing the same domain, and have the correct ID. No information is sent to the server flash is a client side process. Any flash developer worth his salt would never save personal information in a Shared Object. This just sounds like alot of scare mongering by someone who doesn’t understand what this actually is.

Not only does it hand out free information to these companies, but it also slows down web surfing. These types of cookies have never been removed from my computer since I bought it (maybe two years ago). After I removed them, sites that used to take a few seconds to finish loading now load in under a second.

My advise: get rid of them unless you acutally use them.

This should work for Linux users: rm -rf ~/.macromedia

I’m a game developer. Flash’s shared objects are a documented and known feature. Quite often they are used to enhance the quality of the user’s experience by caching data locally. Flash implements a number of security sandboxes and has rules on how these objects are accessed. With Flash 9 and above these rules assist in keeping the usage of SO and other advanced Flash features kosher. Granted, malicious programmers could use these for bad stuff the same way a programmer can use http cookies.

I applaud your effort to inform users about potential risks, but I think a more balanced approach based on facts of how these shared objects are used would have been more useful.The core point here is that users are not fully aware of what software is running on their machines. They may be explicitly trusting applications/plugins that may represent some level of risk.

Flash is a powerful plugin that gives you many desirable features. Like any plugin, it also exposes some new risks. As an industry lets work together to understand the risks, educate each other, and find solutions that allow us to offer rich media experiences that are safe. Let’s not damn a useful technology due to potential risks. Instead let’s work together to define what is acceptable behavior and banish applications/plugins/sites that don’t play by the rules.

This is extremely serious. In many countries it is illegal to visit pornographic web sites, even those which are not blocked by the government censors. So an innocent persion goes to http://www. a creepy pornographic website .com and criminal evidence remains forever on his hard disk.

How does this affect the promised Privacy Mode of IE and Firefox?

If you are worried about a third-party file on your system like these: CCleaner removes these by default with a lot of other crap, where it used to get its name from. http://www.ccleaner.com/

(No, I have no connection to them, other than liking their program and attitude.)

Thanks for uncovering this very-well-kept secret!

With Firefox you can use the “BetterPrivacy” Add-on. Beside deactivating DOMstorage and “click-pinging” (don’t know, what it is), you can look at the *.sol files and delete them with the Add-on. The Add-on has a function for automatic deletion of the *.sol files, but that doesn’t work for me with Firefox 3.

Easy way to clear all flash cookies in Windows for either IE or Firefox. Put the following text into a batch file in your startup folder.

RMDIR “%APPDATA%\Macromedia” /S /Q

This article is somewhat funny. While it did indeed mention the prevention of the cookies and so on into your system, it forgot to mention that there’s a nifty utility called disk cleaner. Among the astonishing number of plug-in si thas this little program did not fail at all to delete everything my flash player had put into HardDrive\user-name\aplication ddata\macromedia\ and the like. It clears everything, including these flash player files. Just use google and find disk cleaner. Have been using it for many years now, I consider this to be my best friend. THe best thing? this is open source!

How can people be accusing Adobe of ‘trying to hide this secret’? I guess clearly documenting something == hiding?

George :Also, how the heck is it Adobe’s fault that your browser doesn’t clear these? Are you expecting Flash hack IE7 or Safari so the clear cookies button also clears the folder that shares local objects?
Shared Objects are stored in known locations and the browsers have nothing stoping them from clearing these locations.

Other companies work with MS to ensure interoperability… why shouldn’t Adobe?

Thanks!

So what about just getting rid of Macromedia/ Adobe garbage? Going to the website of the slime that installed the spyware to get rid of it seems silly. I have Adobe’s pdf reader disabled and have, I think, removed all the flash player crap that came loaded on my laptop.

Is there anyway to tell for sure if its gone??

Bob

I saw this on Slashdot. Use the NoScript Firefox plugin which also blocks Flash and Silverlight by default.

On Linux you should rm -r ~/.macromedia and then ln -s /dev/null ~/.macromedia

On Windows you should delete/rename the “Flash Player” folder residing in C:\Documents and Settings\USERNAME\Application Data\Macromedia\ and replace it with a file called “Flash Player”. This prevents Flash from creating another “Flash Player” folder.

The above I found in the Slashdot comments.

Harold Steptoe :I saw this on Slashdot. Use the NoScript Firefox plugin which also blocks Flash and Silverlight by default.
On Linux you should rm -r ~/.macromedia and then ln -s /dev/null ~/.macromedia
On Windows you should delete/rename the “Flash Player” folder residing in C:\Documents and Settings\USERNAME\Application Data\Macromedia\ and replace it with a file called “Flash Player”. This prevents Flash from creating another “Flash Player” folder.
The above I found in the Slashdot comments.

Harold,

Could you run that by me again, slowly and in language a computer illiterate can understand? If these folders are still there, do I delete the folder or just the contents? If I make another folder of the same name, why won’t the flash player use it?

Rick has the main point.

Bob

Bob,

In linux there’s a simple way to stop Flash from storing LSOs on your computer. this is the graphical way, good for recent Windows converts to linux …

1. Click Places, then Click Home Folder
2. Click View on the Top menu, and select Show Hidden files
3. Find a directory named .macromedia and RIGHT click it.
4. Select Properties at the bottom of the popup menu.
5. Select Permissions tab.
6. Click the selector for Folder Access, and choose List Files Only
7. Near the bottom, Click on Apply Permissions to enclosed Files

You have just made the .macromedia and all subdirectories and files inside it to READ ONLY, nothing can write there. I have done this on all my linux systems. The only ill effects are that I cannot watch full episodes of The Daily Show, and volume settings are not saved from one youtube video to the next.

Happy blocking!

Objection is an add-on for Firefox to manage your Flash Cookies (LSOs)

Bob:

With WinXP :-

The target folder that is used to store the Flash “cookies” is “C:\Documents and Settings\[USERNAME]\Application Data\Macromedia\Flash Player”. If you rename this folder to “Flash Player.disabled” or delete it (your choice) and create a FILE (not a folder) called “Flash Player” then Adobe can no longer recreate the “Flash Player” folder because the name is already in use by a file. The easist way to create this file is to right-click inside the …\Macromedia folder and select the “create text file” option naming it “Flash Player” (not “Flash Player.txt”).

It works because you can’t have a folder and a file in the same directory with the same name.

Harold Steptoe :Bob:
With WinXP :-
The target folder that is used to store the Flash “cookies” is “C:\Documents and Settings\[USERNAME]\Application Data\Macromedia\Flash Player”. If you rename this folder to “Flash Player.disabled” or delete it (your choice) and create a FILE (not a folder) called “Flash Player” then Adobe can no longer recreate the “Flash Player” folder because the name is already in use by a file. The easist way to create this file is to right-click inside the …\Macromedia folder and select the “create text file” option naming it “Flash Player” (not “Flash Player.txt”).
It works because you can’t have a folder and a file in the same directory with the same name.

Harold,

That is a genius solution. Not necessarily because it’s the best technique listed here, but because it’s creative and well, really just quite intelligent. Well said! I love it, and I’m going to impliment it just for the fun of it.

Regards,

Priv A. See

I’m looking at a long list now, but the biggest size is only 3kb. Most are 1 or 2kb out of the 100kb limit. This includes Google video and You Tube. So I doubt this cookie is slowing my browsing down although I am surprised to find them.

If you or any other bloggers using Windows want to earn a quick buck publishing similar poorly researched “privacy panic” articles, there is a ton of material in c:\documents and settings\[USERNAME]\application data\ to keep you busy for quite a while.

Some of you FireFox users might be surprised at what doesn’t get deleted in your Profiles folder when clearing your private data via FF’s menus.

I can’t believe I didn’t know about this earlier!!! I always surf with cookies turned off, I thought I was safe!!! But then the BBC iPlayer remembered my playback position in Opera, when I had previously played it in IE. I thought, how can it know across different browsers, even when I have cookies turned off and use CCCleaner everyday?? Then I rumamged around the Application data folder and found loads of SOL files dating back years!!!! I have teh Adobe Flash player option ticked in CCLeaner, but CCleaner still doesn’t clear them, it has let me down! The world must be told of the danger posed be Flash cookies!!!

hedora, the biggest privacy threat by far is the application people call “Windows” or occasionally “Vista”. It stores and stores and hides from you and obscures and then ships out onto the net. If people trust Windows, that sees *everything* you do on a PC, why would they worry about Sony or Adobe or Google or anyone else whose ability to store anything about you ultimately depends on Microsoft giving them that right? [..since all their applications rely on calls made to Windows libraries for even basic things like using memory, files, and running the application ..eg, in the case of Google, the browser]

In Linux you know what you have and where they can get you if you let them [you may not know but other third party developers do (including the very paranoid ones)]. Of course, I am talking about open source software.

This artical is so correct about the Adobe flash player. I noticed 3 weeks ago when i needed to download an Actvix player for a certain programme, right after downloading the pc was giving me trouble. I could not even scroll, as it was going so fast and would not allow me to click at all.So it was making it impossible to see most things. I also am encountering other problems since the download. I have Norton antivirus, whic i paid for and works well. So this showed no virus.I then realised myself it was the flash player THAT HAD UPSET MY PC

Did anyone read Musashi270 post? Ccleaner erases all flash cookies except ones you choose to keep like from your bank etc.

It is what these can be MADE to do that is the problem 99% may be harmless and useful, it is the abused and misused ones that are the problem. The claim that only the original site can access the information is not as clear as it might be. Most sites have frames or links or ads from third party sites if that third party site puts a flash cookie on your PC the same site can access it from ANY site on which it has a link or frame or ad. SO it would collect which sites you have been to and other details from those sites possibly for years - frightening. If a store hid a camera on you while you were shopping and monitored your entire day claiming to be helping you get targeted ads there would be an outcry but these people have convinced the computing public that cookies are necessary, good and not evil at all. Yet the information they get sells for thousands-Why?

This can also be deleted with Command Prompt script:
{run CMD}
cd “Application Data\Macromedia\Flash Player
rmdir /Q /S #Security
rmdir /Q /S #SharedObjects
rmdir /Q /S localhost
rmdir /Q /S macromedia.com
rmdir /Q /S localhost

* for Vista, change _ Application Data_ to _AppData_

I really like the morons up here trying to aologize for this feature. Hey MORONS: I don’t play stupid computer games, so I don’t give a DAMN about that. I also don’t give a RAT’s ASS if “my pizza place” remembers what I ordered last time.

This is obviously sneaky spyware, from the dirtbags at Adobe. The lame-ass douches up here trying to defend are probably spammers and other psychotics who think it’s wonderful that they can track people’s internet use.

The fact is, these files contain lots of information about your internet history that you might not want known to other people, for example, if your university (e.g. Columbia) BANS sites that the idiots there find “politically incorrect” such as World Net Daily .com.

Any SLIME MOLD who is up here defending this you can know is a slimy dirtbag who is upset that people are finding out about this. I think a lawsuit against Adobe is completely justified. They have always been sneaky bastards with all of their crappy broken software. it’s easy to see why their apps barely function - because the main purpose of them is to invade your privacy.

Scott McNealy is a has-been freak. I don’t give a rat’s behind what this loser slimebag thinks I should be “getting used to”. Sun is going out of business soon, and good riddance to this bucktoothed freak Mcnealy.

wankers