Lawsuit Hits Companies Using 'Zombie' Flash Cookies

A privacy activist has filed a lawsuit targeting eight corporate users of Quantcast's "zombie" Flash cookies, in addition to Quantcast itself. The suit alleges that MTV, ESPN, MySpace, Hulu, ABC, Scribd, and others used Quancast's Flash-based cookies to recreate browser tracking cookies that users had taken the trouble to delete. "At issue is technology from Quantcast, also targeted in the lawsuit. Quantcast created Flash cookies that track users across the web, and used them to re-create traditional browser cookies that users deleted from their computers. These 'zombie' cookies came to light last year, after researchers at UC Berkeley documented deleted browser cookies returning to life. Quantcast quickly fixed the issue, calling it an unintended consequence of trying to measure web traffic accurately. ... The lawsuit (PDF)... asks the court to find that the practice violated eavesdropping and hacking laws, and that the practice of secretly tracking users also violated state and federal fair trade laws. The lawsuit alleges a 'pattern of covert online surveillance' and seeks status as a class action lawsuit."

Comments

BetterPrivacy plug-in

[sphealey]

At least for the Flash cookies on Wintel, the BetterPrivacy plug-in seems to be doing a good job of deleting them for me.

sPh

Re:BetterPrivacy plug-in

[mlts]

+1 on BetterPrivacy. Install that as an add-on, and it works on Windows and OS X. No more worries about Flash shared objects because it can be set to zap them at very short time intervals, as well as when you open or close the browser.

Firefox + BetterPrivacy + AdBlock + NoScript probably do as much for keeping a Windows machine clear of malicious software as most AV programs.

Here is the shitty site

[psyclone]

http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html

Noscript users must temporarily allow adobe.com as well. (But at least you don't need to allow real cookies for either domain.)

You can set the flash plugin to not store any data, but it sure gets annoying on some sites when the volume controls don't work. You can also set it to ask, but it's even more annoying to try and hit the "cancel" button 15 times with choppy video behind it.

Re:Not Quantcast's fault

[Anonymous Coward]

Don't blame Quantcast. They're using the technology as Macromedia intended

You logic is flawed. If I kill a human with a Samurai sword, would you blame the maker of the sword?

Flash comes with every version of Windows since at least XP

Do you mean Dell computers with Windows? Maybe, but no version of Windows ever came with Flash.

Re:On LInux:

[izomiac]

On Windows, in an elevated command prompt:
icacls "%APPDATA%\Macromedia\Flash Player" /setowner SYSTEM
icacls "%APPDATA%\Macromedia\Flash Player" /inheritance:r /deny everyone:F

Though I'd recommend a simple:
icacls "%APPDATA%\Macromedia\Flash Player" /inheritance:d /deny everyone:(WD,AD)

OS X can use this program to delete flash cookies

[qwertyatwork]

OS X can use this program to delete flash cookies http://machacks.tv/2009/01/27/flushapp-flash-cookie-removal-tool-for-os-x/

Re:OS X can use this program to delete flash cooki

[BearRanger]

No program necessary to do this. Just remove ~/Library/Preferences/Macromedia/Flash Player/#SharedObjects. Set up a cron job or an Automator script to do it hourly.

Re:Not Quantcast's fault

[Tacvek]

Actually this is not a troll. Take a look in the C:\windows\help\tours\mmtour folder of a new windows XP 32-bit installation and you will find that the tour is SWF based.

Among other dlls pre-installed on the system is a flash 3 or flash 4, or some similar early version dll (I forget the version or exact file name, but a search for 'flash' or 'swf' in file names on a brand new XP install (you might need to run the tour first to have it appear) should probably find it. I don't believe the browser plug-in ever came pre-installed, but the core DLL most definitely did.