Beware: Flash Cookies

If you read it on Slashdot, you can skip this post 🙂

Some guy writes about a flash web privacy thing with high importance, that I believe many people (incl. me) have never heard about.

Bottom line: the browser options "delete all cookies" or "clear all private data" are not doing 100% of the job. Flash local data can be deleted from here (on Macromedia.com)[1].

Also, you're using flashblock, right? 🙂

[1] I wonder how they secure that thing: after all it's a flash app with privileges for messing with the client's settings!

3 thoughts on “Beware: Flash Cookies

  1. עודד

    The most obvious problem here, is the use of the name "flash cookies" to describe the Adobe Flash localStorage mechanism. The misuse is based on how much Flash developers do not understand how the web works (and I have a lot of experience in such misuse as I work a lot with Flash developers).

    Because in in fact Flash localStorage is nothing like cookies and much more like (actually, exactly like) WHAT-WG's HTML5 draft's localStorage (http://www.whatwg.org/specs/web-apps/current-work/#the-localstorage-attribute), its quite obvious that "delete all cookies" does not clear the so called "flash cookies", because they are not cookies at all.

    On the other hand, both Internet Explorer and Firefox has the option to delete "offline website data" which does clear both the browser's own implementation of localStorge (or globalStorage) and Flash's.

  2. Oren

    Oded: Interesting stuff. However, unlike what you've said, I've just did "Clear private data" in firefox, which includes the "Clear offline web data" option, and still the flash LocalStorage stuff remains!

    I'm using FireFox 3 (IceWeasel) + Flash 9

  3. adam

    I knew something was going on when different websites could identify me so I entered a false name in one and the same name appeared on another site with a different browser AFTER deleting cookies. Also flash player always knows when a new version is released, how could it do that when I don't use it and there are no programs or services running? Conclusion it must somehow be in contact with the website WITHOUT ME KNOWING. Just like a pickpocket.

Leave a Reply

Your email address will not be published. Required fields are marked *