Lawsuit Hits Companies Using 'Zombie' Flash Cookies
A privacy activist has filed a lawsuit targeting eight corporate users of Quantcast's "zombie" Flash cookies, in addition to Quantcast itself. The suit alleges that MTV, ESPN, MySpace, Hulu, ABC, Scribd, and others used Quancast's Flash-based cookies to recreate browser tracking cookies that users had taken the trouble to delete. "At issue is technology from Quantcast, also targeted in the lawsuit. Quantcast created Flash cookies that track users across the web, and used them to re-create traditional browser cookies that users deleted from their computers. These 'zombie' cookies came to light last year, after researchers at UC Berkeley documented deleted browser cookies returning to life. Quantcast quickly fixed the issue, calling it an unintended consequence of trying to measure web traffic accurately. ... The lawsuit (PDF)... asks the court to find that the practice violated eavesdropping and hacking laws, and that the practice of secretly tracking users also violated state and federal fair trade laws. The lawsuit alleges a 'pattern of covert online surveillance' and seeks status as a class action lawsuit."
I hate how Slashdot uses zombie flash cookies to try to keep from getting what the Italians call il primo post.
And forgot to delete those cookies from that porn site I didn't go to.
Flash Sharedobjects aren't the same as cookies. They are often used as save files for Flash games. Then we have badly behaving programs like CCleaner which aggressively try to delete them all until you notice that it's about to delete all your save files, and stop it before it wipes them away.
People who use proprietary plugins like Flash surely are asking for this kind of thing.
It's not like it's a common aspect of the web. Tracking and monitoring of users is ok if they're asking for it by using such things. While we're at it, let's just say that anyone using a browser to access the internet is asking for it. If they use the internet, they deserve to have their privacy infringed upon.
You can't change the !@#$%^& Flash settings on your own computer. You have to go to a Flash website. And you can't manage your flash cookies without going to some obscure website.
It would be the easiest programming thing in the world to let people manage all the Flash settings and cookies right on the computer (no internet).
But noooo... that isn't the way the snoopy Flash people want things to be.
Does anybody else see the irony in the -government- slapping the hands of businesses who -spy- on us?
sudo chown root::root ~yourusername/.adobe/Flash_Player
sudo chmod 0000 ~yourusername/.adobe/Flash_Player
Don't blame Quantcast. They're using the technology as Macromedia intended - to violate your privacy. That's what a Flash LSO does. Blame Macromedia, and now Adobe, for being so secretive about it. But, also blame yourself for not reading up on Flash before installing it, since this is well-documented behavior (just not on any Adobe website). Also, blame Microsoft for not telling you, since Flash comes with every version of Windows since at least XP.
Use Better privacy.
I whitelist all the flash LSOs I want to keep, and have better privacy delete the others when I quit firefox.
Flashblock can also help.
I find noscript annoying.
I also accept all normal cookies for session only, and whitelist sites I want to stay logged in on using Cookie monster.
Zombie Flash Cookies. I'm sure they're bad for you, but you have to admit they sound like they'd be tasty.
Doesn't this fall under the unticircumvention law.
I protect my privacy
You circumvent it
Can we not use their own laws against them ?
Sounds like someone didn't get any zombie flash cookies for dessert tonight
At least for the Flash cookies on Wintel, the BetterPrivacy plug-in seems to be doing a good job of deleting them for me.
sPh
adding *quantcast*(or something like that) to adblock plus. If it isn't there already.
http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html
Noscript users must temporarily allow adobe.com as well. (But at least you don't need to allow real cookies for either domain.)
You can set the flash plugin to not store any data, but it sure gets annoying on some sites when the volume controls don't work. You can also set it to ask, but it's even more annoying to try and hit the "cancel" button 15 times with choppy video behind it.
Its failure to allow plugins to circumvent cookie settings. It sucks that you have to use an addon like BetterPrivacy to delete flash cookies separately from regular cookies.
Ok, Agreed. No copyright laws either though. It's a free-for-all.
This isn't worthy of a lawsuit, this is worthy of a browser extension or plug-in, in-built browser function to manage flash cookies or simply an addition to the flash settings panel.
Oh, wait, this is the US... never mind.
OS X can use this program to delete flash cookies http://machacks.tv/2009/01/27/flushapp-flash-cookie-removal-tool-for-os-x/
Could be interesting for a passive law enforcement tracking id?
You flush them out, they seem like ads?
Domestic spying is now "Benign Information Gathering"
No program necessary to do this. Just remove ~/Library/Preferences/Macromedia/Flash Player/#SharedObjects. Set up a cron job or an Automator script to do it hourly.
Holy sudos, quick robin to the bat terminal!
Your father unzips
Hot semen blankets your face
Like winter snowfall
(now that's how you write a Haiku, you other anonymous coward retards)
flash cookies are old news, at least as old as the habbo hotel raids
Snowden and Manning are heroes.
Adobe create the platform that allows the violation in the 1st place. So why not sue them too??
Are we on Apple's side again for being anti-Flash? (I lose track so easily)
6.8SPC TR of 550, l xwind at 6, drift rt at 26" drops 77". AT has 503 ft-lbs at 1403 fps. FT 0.86
They are the ones that only allow you to delete the cookies by going to their site (adobe), so they know what all of the cookies are, and
that in of itself is a violation of privacy.
The best way to be safe from Flash cookies is to map their locations to RAM disk location. Here is a tutorial that shows how. Look for 'Using RAM disk with other software' section near the end of the page.
http://www.myplanetsoft.com/products/wt/intro/ramdisk/index.php
Windows XP/Vista/7:
Linux:
Place this code into your crontab to run every day.
rm -rf ${HOME}/.macromedia/*
Flash cookies are handled perfectly. You may need to use ${LOGNAME} instead. I've added these lines to the beginning of my daily backup job. Simple. Effective.
Adobe AIR probably does something similar, so check for that crap in a similar manner, if you still have AIR installed. I removed it after 7 days of use. Take about crap. It is slower than Java and bloated even more than iTunes + Outlook + Java, IMHO.
From TFA:
The lawsuit (.pdf), filed in U.S. district court in San Francisco, asks the court to find that the practice violated eavesdropping and hacking laws, and that the practice of secretly tracking users also violated state and federal fair trade laws.
Why hasn't anyone been led away in handcuffs? Are all the broken laws misdemeanors with a small fine, or what? Is it that no rich and powerful man goes to prison unless a richer and more powerful man wants him there? It sure seems so; Sony's XCP, the mine disaster several months ago where there had been repeated fines for the safety violations that ultimately led to two dozen deaths? Someone should have been charged with negligent manslaughter, and from what I've read, so should someone from BP.
Are we back to feudalism?
Free Martian Whores!
Or, as an above poster suggested, substitute the folder with a link to /dev/null.
This needs repeating.
USE A RAMDISK and learn about MKLink. Use it for any temp data you can get away with.
I run Windows 7 x64, I have 4GB of memory and I dedicate 512MB to a RAMDisk. I point Flash, IE and Chrome temp directories to the disk.
I've found that unless I'm running multiple VM's I can give up the memory with no negative side effects. In fact, browsing is slightly quicker.
There also is a little trick you can use!
1. Delete the SharedObjects directory.
2. Create a file called SharedObjects ( the same name of the now deleted directory).
3. Make that file read only, ( plus any other permissions you feel are safe ) to prevent it from being deleted.
VOILA! Flash can no longer make the shared objects directory because a file is occupying that name-space. Of course it might break some flash apps that need the shared objects to run but that's the price.
On a serious note, I wonder if browsers with private browsing modes sandbox flash cookies? When you go back to normal browsing mode, will the flash cookies from tentaclerapecentral.com still be mixed in with your other flash cookies? Let's find out!
I'm going to clear my flash cookies, disable BetterPrivacy, then mess around in the Adobe Flash settings page in private browsing mode. This will cause my browser to pick up flash cookies.
Then I'll go back into normal browsing mode and look in my flash cookie folder and see what's there.
Results: Flash cookies that were created in Private Browsing mode still exist! DUN DUN DUN!!!!
(Done in Iceweasel 3.5 with Flash 9.x)
"When information is power, privacy is freedom" - Jah-Wren Ryel
Maybe there are some good reasons to not allow Flash on your platform?
I think it would have been funnier if you had said "bash terminal".
Sure I'm paranoid, but am I paranoid enough?
I dun goofed :(
People who use the Internet surely are asking for this kind of thing.
A cookie could be inserted that you never had.
I can see the defense in court -- the Keebler Elves made me do it. They kept giving me those cookies and now I am 5000# and in jail.
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.