You Deleted Your Cookies? Think Again

http://www.wired.com/epicenter/2009/08/you-deleted-your-cookies-think-again/

by edw519 • 17 years ago

88 28 17 years ago

blasdel• 17 years ago

Unmentioned in the fluff article: Since flash cookies are set in a user-global location, they are the same live across all browsers. As an added bonus, they completely defeat "private browsing" everywhere I've tried it.

paraschopra2• 17 years ago

I bet future versions of browsers would clear such cookies as well. Flash is almost a standard feature of every browser now.

Devilboy3• 17 years ago

Including the Chrome 'Incognito' mode?

andreyf• 17 years ago

Not an expert, but I'd imagine so. Unless they do some wicked hackery, Chrome can't restrict what a Flash plugin executable does with an SWF file.

yb• 17 years ago

I've made the "#SharedObjects" directory read-only.

Since then I've been using flash without any problems - the only noticeable effect is that I have to reset the volume on youtube videos each time I play a video.

gojomo3• 17 years ago

I'm wondering if there's some similar permanent iPhone ID available to apps.

I did a 'full wipe' on my iPhone3g and gave it to my sister -- but then when she installed Pandora, it started pre-logged-in to my account. The only mechanisms I can imagine for that are (1) (less likely) an app-addressable storage area, like cookies, that's spared the 'full wipe'; (2) a permanent device ID that apps can use as if it were an unerasable, global cookie.

naz• 17 years ago

[[UIDevice currentDevice] uniqueIdentifier]

gojomo3• 17 years ago

Thanks. I accept that installed apps have privileged access to such per-device IDs, and can see why Pandora finds it useful... but it seems there should be some guidance against such use, or a mechanism for breaking such associations after a 'full wipe'. (Perhaps, the last part of the ID is an counter that increments each wipe.)

My sister seeing my Pandora stations is no big deal but if it had instead been a stranger I'd sold the unit to, that'd be more of a concern... and if other apps do the same thing, more important personal information could be at risk.

barrkel• 17 years ago

I guess this is still irrelevant if you use FlashBlock. I know I've seen many sites that don't obviously use Flash, except for the existence of a flashblock item in the top-left corner - my guess at the time was that it was tracking.

bretthoerner2• 17 years ago

Not totally irrelevant, I assume you sometimes enable a flash embed or two. Just because it plays a movie (or whatever) doesn't mean it isn't tracking you, too.

jimmybot• 17 years ago

If you want, you can delete your flash cookies using the BetterPrivacy Firefox Add-On: https://addons.mozilla.org/en-US/firefox/addon/6623

Should delete globally so you can use it even if you don't use Firefox.

paraschopra2• 17 years ago

To see your Flash Cookies, go to http://www.macromedia.com/support/documentation/en/flashplay...

solutionyogi2• 17 years ago

Wow, horrible application. First, Chrome gave me warning that ActionScript is too slow. And when you click on 'tabs', a new page is loaded even though it's a flash application! And why do they need a separate page for this? Why is it not accessible when I right click a Flash movie?

bretthoerner2• 17 years ago

Because this sneaky privacy bypass is a huge selling point for Flash (for businesses, obviously).

gojomo3• 17 years ago

Product manager's checklist for this functionality:

_✓_ can claim to privacy advocates cookies are viewable and clearable

_✓_ obscure enough no user ever finds it without help

_✓_ so hard to use no one would revisit casually

Your questions confirm: total success!

jdowdell• 17 years ago

<em>"Why is it not accessible when I right-click a Flash movie?"</em>

It is... the context menu always holds at minimum a "Settings" link.

For "Why is it on a webpage instead of in the SWF?", it's because Flash is part of a webpage, and is often not sized large enough to display a dialog. Unlike a browser, Flash has no chrome of its own -- it's a component.

For "Why isn't this integrated with the new browser privacy controls?", this is a work item now that browsers offer privacy controls... a Mozilla example: https://bugzilla.mozilla.org/show_bug.cgi?id=508167 https://bugzilla.mozilla.org/show_bug.cgi?id=290456

aw3c2• 17 years ago

yet another reason not to install Flash.

keyist• 17 years ago

Unix's everything is a file versus Adobe:

  ln -s /dev/null ~/.macromedia
  ln -s /dev/null ~/.adobe

Winner: Unix

codedivine• 17 years ago

Wonder what happens if you use Flashblock?

4chan4ever• 17 years ago

Finally... this has been blogged about for at least a year.

http://www.codingthewheel.com/archives/online-gambling-priva...

gradschool• 17 years ago

One comment suggests running the browser in a virtual machine and restoring from a snapshot at the beginning of each session, which is also what I do and has worked out well. Using Virtualbox, the bookmarks file can be separately mounted on a so-called writethrough image to allow persistent updates. There are some difficulties with the shared clipboard but ssh between the host and vm is a workaround.

You Deleted Your Cookies? Think Again

Related Stories