The Mac Observer

Flash Cookies: The Newest, Secret Way to Invade Your Privacy

TMO Talk (52)

Many users periodically purge their cookies in browser settings to prevent tracking. However, the industry, with the help of Adobe Flash, has found a way to store a new kind of cookie that can't be managed by a browser. They're much bigger, up to 100 KB, and can even reconstruct conventional cookies after they've been deleted. Here's the background and how to block them.

A study at the University of California, Berkeley, released on August 10, 2009, entitled, "Flash Cookies and Privacy" revealed that many popular websites are using "Flash Cookies" to circumvent privacy practices by users with conventional cookies.

The abstract said: "We find that more than 50% of the sites in our sample are using flash cookies to store information about the user. Some are using it to 'respawn' or re-instantiate HTTP cookies deleted by the user. Flash cookies often share the same values as HTTP cookies, and are even used on government websites to assign unique values to users. Privacy policies rarely disclose the presence of Flash cookies, and user controls for effectuating privacy preferences are lacking."

The research team found that Flash Cookies are preferable because they can better track a user's habits, can't be managed by a browser, and have no expiration date.

In order to manage your Flash Cookies, you must go to an Adobe Website which, in turn, interacts with Flash on your Mac or PC to set preferences. It's under the heading of "Flash Player Help" and can easily be overlooked as a page that actually manages Flash on your own computer.

For example, you can see your Flash cookies in the "Website Storage Settings Panel." it's on the upper left. Doing so, I found that I had about 160 of these Flash Cookies that I had no knowledge of.

 

Flas Cookies list

Website Storage Setings; Your list of Flash Cookies

You can delete them all the with "Delete all sites" button, but that doesn't prevent them from recurring. To permanently block them, you must go to "Global Storage Settings Panel."

Flash Cookies control

Global Storage Setings Panel: Block Flash Cookies

Uncheck the box that says, "Allow third-party content to store data on your computer." Note that this may reduce the functionality of Flash in the future.

There has been a lot of discussion about this practice in the last month. Not only does the practice violate the spirt of user control over cookies, but, worse, the practice has been lurking, unseen, unknown, until the UC Berkeley report.

In one instance, the researchers found a case where, "at least one site used a Flash cookie even when the user had opted out of tracking through the Network Advertising Initiative's opt-out cookie," as explained by Wendy Davis at the The Daily Online Examiner.

Clearly, some websites will use this secret technology track your habits for their own ends even if you thought you opted out and exercise what you think is due diligence with conventional cookie handling.

One has to wonder if this is yet another reason why Flash has left a bad taste in the mouth of Steve Jobs.

Post A Comment or Log-in. Need an account? Register here.

25 Observer Comments

I have or rather had) those annoying Kontera pop-up links disabled but they keep coming back.  I go to their web site and disable them.  But when I come back to this article, they are enabled again.  I wonder if they are using Flash Cookies (which I disabled).

   Actions Yahtzee said on September 17th, 2009 at 1:25 PM (Edited: 09/17/2009 4:13 PM):

Dude! Thanks for posting this.

   Actions Lee Dronick said on September 17th, 2009 at 1:33 PM (Edited: 10/18/2011 6:20 PM):

John, thank you very much for this post.

I deleted all those damn Flash cookies, there was even one from .me!

I thought that I hated Flash before

   Actions Nemo said on September 17th, 2009 at 2:05 PM (Edited: 04/06/2011 11:14 AM):

John:  Thanks.  This is tremendously useful and, I believe, little known information.  I am handing this info to friends and our IT Administrator.  But you should look at the other settings in the Settings Manager.  Flash, according to what is there, can also be used by third parties to gain remote access to the camera and microphone on your computer; it can also allow some websites to access information about other sites that you visit by using an older system of security.  I think that your readers would benefit by reviewing all of the settings in the Settings Manager to determine whether the default settings are consistent with their security policies.

And let’s hope that audio and video capabilities of HTTP5 put a quick end to Flash or at least begin the end of Flash.

   Actions Islandgirl45 said on September 17th, 2009 at 2:14 PM (Edited: 09/17/2009 2:56 PM):

I’m having a problem with Flash Player that involves the Global Storage Settings in a slightly different way.

Frequently, when I’m viewing a page with a video like the the Daily Show on Comedy Central it shows as a gray box with an error message that reads:“User must allow third-party flash content.” To do that, the message directs you to: Flash Player storage

But when I try to adjust storage levels, the level I choose keeps sliding back to default. This occurs in both Firefox 3.5.3 and Safari 4.

As a result, I keep getting the storage adjustment message and some videos like the Daily Show just won’t play. I’ve filed a bug about Flash with Adobe and their tech person didn’t know why this is happening. I’m running 10.4.11 but others who have encountered the same bug are using 10.5.

   Actions CrazyHarry said on September 17th, 2009 at 2:15 PM (Edited: 09/17/2009 5:20 PM):

I really appreciate this info, but you really should warn people that doing this breaks Flash functionality.  I just spent 10 minutes wondering why a video on the WSJ wouldn’t play, when it dawned on me that following your advice broke Flash.

If any politician would promise to implement the death penalty for spammers and people who implement crap like these Flash cookies, I would vote for them in a heartbeat.

   Actions Lee Dronick said on September 17th, 2009 at 2:38 PM (Edited: 10/18/2011 6:20 PM):

I really appreciate this info, but you really should warn people that doing this breaks Flash functionality.

That is good, Flash needs to go away.

I just spent 10 minutes wondering why a video on the WSJ wouldn’t play, when it dawned on me that following your advice broke Flash.

Did you pay Murdoch’s subscription fee smile

   Actions CrazyHarry said on September 17th, 2009 at 2:52 PM (Edited: 09/17/2009 5:20 PM):

CrazyHarry said: I really appreciate this info, but you really should warn people that doing this breaks Flash functionality.
That is good, Flash needs to go away.

Don’t be a nuckfut.  Flash is a pain, but it is also currently a major tool for accessing a lot of content on the web.  If Macobserver is going to give people advice about how to configure software on their computers, then they ought to inform the readers of the full consequences and let individuals decide for themselves which is more important to them, privacy or being able to access content on the web.

date="1253212738">

Did you pay Murdoch’s subscription fee

Why is that your business, nuckfut?

   Actions Lee Dronick said on September 17th, 2009 at 3:07 PM (Edited: 10/18/2011 6:20 PM):

Why is that your business, nuckfut?

See this MacObserver story Wall Street Journal

Most websites deliver content without the putting the burden of Flash on their visitors, adverts not withstanding. I stand by my statement; Flash needs to go away.

   Actions John Martellaro said on September 17th, 2009 at 3:10 PM (Edited: 07/29/2011 1:39 PM):

Calm down fellas.  I added a warning in the article.  Let the buyer decide and beware.

   Actions Lee Dronick said on September 17th, 2009 at 3:17 PM (Edited: 10/18/2011 6:20 PM):

Okay, I just had a lemonade and am cooled down a bit.

Question, if the 3rd parties were storing stuff on our computers, where is located? Maybe we could do a folder action to trash the contents or at least alert the user when something is put in there.

I ran across the whole flash cookie thing a few months back. What I found is that if I change the Adobe settings to not allow any local storage then it results in blocking flash that I want to see at some sites. So I have just been deleting the flash cookies.

If use Finder and look here:

~/Library/Preferences/Macromedia/Flash Player

You will find a #SharedObjects folder that contains a sub-folder of a random name. Delete all the files in that folder.

I have also noticed a macromedia.com folder in the same location as #SharedObjects. Drilling down to the support >> flashplayer >> sys folder I see that sites store their settings there. While not technically cookies, you may want to delete all or some of these as well.

There are some Firefox add-ons such as Better Privacy:

https://addons.mozilla.org/en-US/firefox/addon/6623

which will automatically delete flash cookies if you desire but I have not found anything similar for Safari yet. (although it may be out there)

It looks like Safari Cookies may do this to but I haven’t tried it yet:

http://sweetpproductions.com/safaricookies/index.htm

Besides being added to the article, the Adobe settings pages the article links to also warn that certain settings will mean losing functions on some sites. Turning all the features off just to see which sites are saving information without disclosing they are can be pretty enlightening in and of itself.

   Actions Lee Dronick said on September 17th, 2009 at 3:53 PM (Edited: 10/18/2011 6:20 PM):

Thanks Carl

I looked in those folders and there was a lot of stuff in from sites that I never visited, they look like ads. Of course there were items from sites that I did visit.

I added a folder action to them and will see how that works out.

   Actions Lee Dronick said on September 17th, 2009 at 3:57 PM (Edited: 10/18/2011 6:20 PM):

Turning all the features off just to see which sites are saving information without disclosing they are can be pretty enlightening in and of itself.

Well the folder action I applied warns me that something was added when I opened this page. It was an empty folder.

   Actions Lee Dronick said on September 17th, 2009 at 4:05 PM (Edited: 10/18/2011 6:20 PM):

Hmmm, if i leave the empty folder in the #SharedObjects folder then refresh this page then nothing gets added.

   Actions Russell said on September 17th, 2009 at 5:00 PM (Edited: 09/18/2009 3:41 PM):

It looks like Safari Cookies may do this to but I haven’t tried it yet:

http://sweetpproductions.com/safaricookies/index.htm

I am the Dev for Safari Cookies, and while there is no support for managing the Flash cookies, there is an option to remove all Flash cookies when Safari is quit.

   Actions John Martellaro said on September 17th, 2009 at 5:19 PM (Edited: 07/29/2011 1:39 PM):

Thanks for letting us know, Russell!

-JM

   Actions Nemo said on September 17th, 2009 at 6:15 PM (Edited: 04/06/2011 11:14 AM):

Dear Russell:  I just explored the preferences for Safari 4.0.3, running on Snow Leopard, but I couldn’t find any option that explicitly addresses removing Flash, LSO, cookies.  Would you or anyone please describe the procedure for having Safari remove LSO cookies, when it quits?

Thanks for your help.

   Actions Russell said on September 17th, 2009 at 6:20 PM (Edited: 09/18/2009 3:41 PM):

You need to install my plugin Safari Cookies, available here: “http://sweetpproductions.com/safaricookies/index.htm” and select the option to remove all Flash cookies.
(if you are running Snow Leopard, you will need to follow the instructions on that site to enable Safari Cookies”

Dear Russell:  I just explored the preferences for Safari 4.0.3, running on Snow Leopard, but I couldn’t find any option that explicitly addresses removing Flash, LSO, cookies.  Would you or anyone please describe the procedure for having Safari remove LSO cookies, when it quits?

   Actions CrazyHarry said on September 17th, 2009 at 7:15 PM (Edited: 09/18/2009 11:42 AM):

See this MacObserver story Wall Street Journal

Most websites deliver content without the putting the burden of Flash on their visitors, adverts not withstanding. I stand by my statement; Flash needs to go away.

O.K., I’ll try to be a little more civil while carrying the debate forward.

Harry, I am going to blow your mind.

I also install another really crappy piece of software, Real Player, on my Mac solely so I have the ability to PAY $6.95 a month to watch BBC World News.  Are you going to argue that because you don’t like crappy software, Real Player should go away?  Or, that because you don’t think people should be allowed to charge for their content, that I shouldn’t be allowed to watch the BBC? 

Flash is crap, but I choose to install it any way.  Why should that bother you?

   Actions Nemo said on September 18th, 2009 at 10:53 AM (Edited: 04/06/2011 11:14 AM):

Dear Russell:  Thanks for the information, but since I am running Safari in its default 64-bit mode, I will wait until you update Safari Cookies to run in 64-bit mode.

here it is:

http://sweetpproductions.com/safaricookies/updates/updates.htm

Dear Russell:  Thanks for the information, but since I am running Safari in its default 64-bit mode, I will wait until you update Safari Cookies to run in 64-bit mode.

Post A Comment or Log-in. Need an account? Register here.
 

Recent Headlines - Updated May 27th

Sat, 10:00 AM
MacOS KenDensed - MacOS KenDensed: Apple’s Patent Lawsuit & Antitrust Shuffle
Fri, 5:58 PM
News - Sotheby’s to Auction Steve Jobs Atari Memo (Photo Gallery)
5:42 PM
Free on iTunes - 3 Free iOS Apps for News Hounds
3:00 PM
Rumor - Nest Thermostat Reportedly Coming to Apple Retail Stores
2:40 PM
Particle Debris - The TV Industry’s Dreadful Little Secret
2:33 PM
News - Mobile Devices Account for 20% of Web Traffic in US, Canada
12:49 PM
News - Apple Now Offering “Free App of the Week” for iOS
12:21 PM
News - Tim Cook Declines $75 Million Dividend Payout
11:25 AM
News - Absinthe 2.0 Provides Untethered Jailbreak for iOS 5.1.1
11:09 AM
Quick Look Review - F18 Carrier Landing (iOS) is a Boatload of Fun
10:51 AM
TMO Appearances - Jeff Gamet talks Cool Apps & Accessories on Not Another Mac Podcast
10:12 AM
Hot Forum Topic - Forum Poll: Which is Your Favorite Photo Sharing Service?
 

The Mac Observer Reader Specials

  • Macsales for the Right Mac Memory. Easy to Use Online Guide for no Guesswork! Mac Pro up to 128GB, iMac up to 32GB. MacBook/MB Pro, & Mac mini up to 16GB. - Macsales.com
  • Mac RAM Upgrades: MacBook Pro 16GB kits $475, 8GB Kits for $119.99! iMac 16GB RAM Kits (4x 4GB) for $229.99! Mac Pro Memory 32GB Kit for $399.99, 64GB Kit for $889.99! Mac Hard Drives 2TB Seagate SATA II for $249.99! Click Here!
  • Macpokeronline.com If you're using a Mac, then you've gotta check out PokerOnAMac.com. Online casinos and poker rooms are literally giving away cash and the casino sites at Poker on a Mac do the unthinkable, they actually reward! Join today, the download is free!
  •  Looking to find online casinos for mac? We can help you find the best real money casino sites where you can play your favorite casino games including blackjack and slots.

Apple Stock Quote (AAPL)

Loading...

Hot Topics

TMO Express

Join the TMO Express Daily Newsletter to get the latest Mac headlines in your e-mail every weekday. Find out more!

Top Deals From DealBrothers.com

Recent Features

Support The Mac Observer

We noticed you may be running AdBlock on your computer. It takes real money to run this site and to deliver the news, tips, and opinions you love to read.

If you wish to block the ads that pay for the creation of our content, we ask that you instead support TMO Directly, either with a $5 monthly recurring contribution, or a one-time donation of any amount of your choice. Thanks!

Subscribe with Paypal Donate with Paypal