Slashdot Mirror
Adobe Flash Cookies Raising Privacy Questions Again
Nearly a year after we discussed the privacy implications of Flash cookies, they are in the news again as the US government considers revising its cookie policy. Wired covers a study out of UC Berkeley exposing questionable practices used by many of the Internet's most-visited Web sites (abstract). The most questionable activity the report exposes is known as "respawning": after a user has deleted browser tracking cookies, some sites will use information in Flash cookies to recreate them. The report names two companies, Clearspring and QuantCast, whose technologies reinstate cookies for other Web sites. "Federal websites have traditionally been banned from using tracking cookies, despite being common around the web — a situation the Obama administration is proposing to change as part of an attempt to modernize government websites. But the debate shouldn't be about allowing browser cookies or not, according Ashkan Soltani, a UC Berkeley graduate student who helped lead the study. 'If users don't want to be tracked and there is a problem with tracking, then we should regulate tracking, not regulate cookies,' Soltani said."
Porn mode ftw.
ln -s /dev/null ~/.macromedia
Spread across a reasonable number of annoyed individuals, paying to have a private investigator tail high level officers and major shareholders of advertising corporations that engage in this sort of thing 24/7/365 would be fairly inexpensive and amusing.
Droooooollllll!!
"If users don't want to be tracked and there is a problem with tracking, then we should regulate tracking, not regulate cookies"
I'm glad we're agreed then. Cookies are used for tracking, so cookies should be regulated. But we won't treat cookies like they're special -- we'll regulate all other forms of tracking as well. That seems fair. In other, unrelated news -- anonymity doesn't exist. Sherlock Holmes may be a fictional character several hundred years dead now, but what he said back then applies today on the internet (which I paraphrase here) "Every place you go, you leave something behind and you take something with you." Tracking, therefore, is just a matter of following the (achem) tracks, and it's something anyone with a bit of skill can do.
The problem is, we're failing society as professionals in the IT field -- part of our work (which most likely isn't earning you money) is teaching our friends, family, and interested parties about these problems and how to protect themselves from it because nobody else can or will. That's what has allowed this kind of crap to permeate into the mainstream... It wouldn't be tolerated if people knew better.
#fuckbeta #iamslashdot #dicemustdie
'If users don't want to be tracked and there is a problem with tracking, then we should regulate tracking, not regulate cookies,' Soltani said."
Really, I can't think of a single good reason for the government to use tracking cookies. There are a few simi-legitimate reasons for third-parties to use tracking cookies, but they should not be regulated. If you don't want cookies either
A) Configure your browser to reject certain cookies
B) Clear cookies
C) Clear your Flash cookies
D) Write to a few OSS developers and tell them if you want a privacy program, or add on
Seriously, if people are -that- paranoid they should do the research to figure out how to disable them. If Flash cookies scare them that much, use Flashblock or don't even install Flash.
The next thing we know the senate will try to pass a bill removing all cookies because those are the things that cause Windows to be slow and spread viruses right? Its just like the '90s, all over again.
Taxation is legalized theft, no more, no less.
...on Windows and on Linux (not sure about Mac OS X) Adobe keeps flash data in two directories. Under Linux you'll find them right in your user home directory hidden as ".adobe" and ".macromedia".
In Windows, you'll find them in the hidden directory "Application Data" in your user directory. They are named "Adobe" and "Macromedia" as well. In Windows 7 (I've been messing around with the RC) you'll find a hidden directory within a hidden directory called "Roaming". I don't know about Windows Vista because I never touched it. This "Roaming" folder should contain the same folders mentioned above.
In any event, if you are so concerned about this issue: DELETE THESE DIRECTORIES. I would advise to be careful of the "Adobe" directory if you use other Adobe software, as there will be more than just Flash player data. Poke around. It's not hard to spot what needs to go and what needs to stay. I don't use any other Adobe software myself so I just have scripts written up to kill these folders on a timed basis.
Thanks for that link, very cool.
Pete/Petri "damn, my chainsaw is clogged with 1's and 0's again." --clyde
Firstly what business have Clearspring and QuantCast doing anything on your machine? Block them in your hosts file.
Then block Flash for hosts you haven't explicitly allowed.
Optional third step: Block javascript for hosts you haven't explicitly allowed.
Finally, not many people know about this, there's a Firefox extension (mentioned in a post above) for deleting Flash cookies every time you close the browser. This should be a standard feature.
There are some Firefox add-ons that supposedly delete these "super" cookies. Here is one example.
I have no idea how well they actually work.
Flashblock
Go here to see all the flash cookies and delete any and all you don't want. Might not be as easy as deleting a directory, but I don't necessarily want to delete them all.
In Firefox, the "Better Privacy" addon deletes flash cookies. Any browser that doesn't offer that kind of control is not worth getting. In my opinion, Firefox without "TACO" (auto creates a bunch of "opt out" cookies without any identifing details), "Better Privacy" (removes flash cookies)and "NoScript" (prevents unwanted scripts - including site-jacking stuff), is not fully installed.
excitingthingstodo.blogspot.com
BleachBit is an open source cleaner for Linux and Windows. It cleans Flash cookies and 50 other items.
Got it scheduled to run periodically and it never causes a problem. Of course I also use ABP and Noscript so most the flash objects I do get are ones that are safe anyway. For those interested Flash stores it's crap in: C:\Users\nicon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects Probably somewhat similar on other OS' user home directories as well.
Thanks for the link! Note: That does not clean multiple installations of Opera, or clean other browsers.
Adobe has become an evil, badly managed company, in my opinion. Buy Creative Suite, and the new DVD requires a download of more than 300 Megabytes to bring it up to date.
You can view/delete your flash cookies here: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html
There's also a firefox plug-in: http://objection.mozdev.org/
I agree, regular tracking regardless of the technology used.
Why can't the cookie blocker and/or cookie cleaner take these out as well? This is presented that only some arcane going to the Adobe website can deal with them. Why are they so hard to kill otherwise?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I tried the "Better Privace" addon to see which flash cookies I have and was surprised to see very few (gmail mainly). When running CCleaner, even these were removed (only the Adobe Flash settings were left).
http://www.ccleaner.com/
Anyone have an up-to-date list of the clearspring and quantcast ip addresses so we can 127.0.0.l them in our hosts file as an added protection measure besides the other solutions listed here? Thanks!
... is also going to become another thing people will need to watch out for.
Any old site can use up to 5MB (10MB in IE) of space on your HDD for whatever the hell they want, really. (i think these were the numbers, it is what i read the other day there when looking up some stuff)
Although i'm not sure if a site has to be given permission beforehand, like how Gears asks for permission for sites to use it.
I would surely hope that this was a consideration for the spec, but i haven't gotten around to reading the full HTML5 spec yet. (might do that tomorrow actually)
I just hope they don't bullshit around with "only allow a site to host X bytes of storage" like in Flash, it is bad enough there is a difference between The Good Group and the Hell-spawn itself AKA Internet Explorer.
What I do: #remove the existing macromedia directory and set a link to /dev/null .macromedia && ln -s /dev/null .macromedia
$cd && rm -rf
Be Safe!
Dietrich T. Schmitz & Associates
Cloud Computing Services
I'm in. Where's the paypal button?
Just curious, do you ever actually read any responses to your posts? Or are you just another drive-by poster who has no intention of actually participating in anything resembling conversation? Seems like the latter case describes you. A lot of users identifying themselves as female seem to think that's a really cool thing to do. All it really means is that anyone with some sense won't bother reading or replying to anything you post.
flash wants to grant access to my mic and camera to every damn website in the fucking world? Shouldn't it be denied by default and ask the user before granting that permission? To me this would certainly cut down on some of the flash vulnerabilities because now it's accessing other subsystems such as the MS Speech setup.
Mod me up/Mod me down: I wont frown as I've no crown
i would like to remind that ANY kind of law is a regulation. including the laws that ban and punish murder, including the laws that prevents people from funding private armies, or cutting other people's heads.
if you dont oppose such laws, you shouldnt oppose proper regulations.
and no. there are no differences in between 'regulation' and 'laws'. that's some delusion that hordes of republicans have created in america through endless yelping.
Read radical news here
There is more than one URL: Adobe's Flash settings widget. You have settings_manager03.html. Adobe has been recommending settings_manager07.html.
The Flash updating tool is very buggy. It may update only your installation of Opera, instead of Opera and Firefox. If you have multiple installations of Opera, it will update only one of them.
In Windows, it is necessary to use the Replace.exe command to replace all instances of flashplayer.xpt, NPSWF32.dll, and NPSWF32_FlashUtil.exe. The latest version of the files is located at C:\WINDOWS\system32\Macromed\Flash after updating one installation of one browser.
Read the article and all the comments, installed BetterPrivacy and it works great. Using the default configuration, it deleted 140 Flash Cookies/LSOs. No problems with any of the sites I normally use. I also use Flashblock, Ghostery, and NoScript.
Great suggestion. Hell, I'd pay money to watch something like that.
And I'm not the only one. Remember Michael Moore's movie "Roger & Me" when he tailed people like the head of General Motors, and ridiculed rich folks like Bob Eubanks filming him living high on the hog at parties that actually degradingly hired people to stand still as human statues so as to entertain the party guests at a time when the city of Flint, Michigan was falling apart?
Millions of people paid money to watch that movie and see the lens turn for once.
http://en.wikipedia.org/wiki/Roger_&_Me
Consider the effect of that, which is to cause people to have even less confidence in Adobe.