Local Shared Objects (LSO), commonly called flash cookies (due to their similarities with HTTP cookies) are pieces of data that websites which use Adobe Flash may store on a user's computer. Local Shared Objects are used by all versions of Adobe Flash Player and Version 6 and above of Macromedia's now-obsolete Flash Player.[1]
While websites may use Local Shared Objects for purposes such as storing user preferences, there have been privacy concerns regarding Local Shared Objects.
Contents |
Local Shared Objects contain data stored by individual websites. With the default settings, the Flash Player does not seek the user's permission to store Local Shared Objects on the hard disk. By default, a SWF application running in Flash Player from version 9 to 11 (as of Sept 1, 2011) may store up to 100 kB of data to user's hard drive. If the application attempts to store more data than the allotted default, the user is shown a dialog to allow or deny the request for more storage space.[2]
Adobe Flash Player does not allow 3rd-party Local Shared Objects to be shared across domains. For example, a Local Shared Object from "www.example.com" cannot be read by the domain "www.example2.com".[1] However the first party website can always pass data to third party via some settings found in the dedicated XML file and passing the data in the request to the third party. Also third party LSO are allowed to store data by default.[3][4]
Users can disable Local Shared Objects using the Global Storage Settings panel of the online Settings Manager at Adobe's website.[5]. However, using this feature will permanently place a flash cookie on the user's computer, informing all other websites that the user does not want flash cookies stored on their computer. Users can also opt-out of them on a per-site basis by right-clicking the Flash player and selecting 'Settings' or using Website Storage Settings panel. The latter also allows users to delete Local Shared Objects.[6]
Users may also delete Local Shared Objects either manually or using third-party software. For instance, BetterPrivacy,[7] a Firefox add-on, or CCleaner, a standalone computer program for Microsoft Windows, allow users to delete Local Shared Objects on demand.
Browser control refers to the web browser's ability to delete Local Shared Objects and to prevent the creation of persistent Local Shared Objects when privacy mode is enabled. As for the former, Internet Explorer 8, released on 19 March 2009,[8] implements an API that allows browser extensions to co-operate with the browser and delete their persistent data stored when user issues a Delete Browsing History command.[9] However, two years passed since its introduction until Adobe, on 7 March 2011, announced that Flash Player v10.3, which was still in development at the time, supports co-operating with Internet Explorer 8 or later to delete Local Shared Objects.[10]
Also on 5 January 2011, Adobe Systems, Google Inc., and Mozilla Foundation finalized a new browser API (dubbed NPAPI ClearSiteData). This will allow browsers implementing the API to clear Local Shared Objects.[11] Four months later, Adobe announced that Flash Player 10.3 enables Mozilla Firefox 4 and "future releases of Apple Safari and Google Chrome" to delete Local Shared Objects.[10] The actual use of this new feature in Firefox remained consistent for all versions up to and including Mozilla Firefox 7: it changed the cookie concept to include LSOs, and therefore the same rules for deletion that in previous versions applied only to HTTP Cookies, would now apply to Flash LSOs as well.[12][13]
This caused loss of data and backward-incompatible flash application behavior[14] for those Firefox and Flash users which used HTTP cookies and Flash Local Shared Objects for different goals. Mainly this had an impact on the flash gaming community, which relies heavily on Flash LSOs to store saved games.[15][16] The resulting support requests cannot be solved favorably for the Mozilla Firefox users without changes to the browser, because of the introduced equivalence between HTTP and Adobe Flash cookies.[12] [13]. Currently the workaround in use is to either configure the browser to never clear history data and cookies, or to revert the part of the changes affecting this use case, using third-party patches.[17]
As for the behavior in browser's privacy mode, Adobe Flash Player 10.1, released on 10 June 2010, supports the privacy modes of Internet Explorer, Mozilla Firefox, Google Chrome and Safari. Local Shared Objects created in privacy are discarded at the end of the session. Those created in a regular session are also not accessible in privacy mode.[11][18]
The default storage location for Local Shared Objects is operating system-dependent.
On Microsoft Windows NT 5.x, they are stored in:[19]
On Microsoft Windows NT 6.x, they are stored in:[19]
On Mac OS X, they are stored in:
On Linux or Unix, they are stored in:
For Linux and Unix systems, if the open-source Gnash plugin is being used instead of the official Adobe Flash, they will instead be found at:
As with HTTP cookies, Local Shared Objects can be used by web sites to collect information on how people navigate those web sites even if people believe they have restricted the data collection.[20] Online banks, merchants or advertisers may use Local Shared Objects for tracking purposes.[21]
On 10 August 2009, Wired magazine reported that more than half of the top websites used Local Shared Objects to track users and store information about them but only four of them mentioned it in their privacy policy. "Flash cookies are relatively unknown to web users," it said, "even if a user thinks they have cleared their computer of tracking objects, they most likely have not." The article further asserts that some websites use Flash cookies as hidden backups, so that they can revive HTTP cookies when user deletes them.[22]
According to New York Times, since July 2010, there had been at least five class-action lawsuits in the United States against media companies for using Local Shared Objects.[23]
In certain countries it is illegal to track users without their knowledge and consent. For example, in the United Kingdom, customers must consent to use of cookies/Local Shared Objects:[24][25]
| “ | Cookies or similar devices must not be used unless the subscriber or user of the relevant terminal equipment:
|
” |
|
—Information Commissioner's Office |
||
Local Shared Objects were the first subject to be discussed in the Federal Trade Commission roundtable in January 2010.[26] FTC Chairman Jon Leibowitz has been talking with Adobe about what it describes as "the Flash problem." [27]
| Software | Developer | Operating system | First public release | Latest stable version | License |
|---|---|---|---|---|---|
| Cookie Stumbler | WriteIt! Studios Ltd. | Mac OS X 10.6 - 10.7. | 2011 | 1.4.1. | Shareware |
| BetterPrivacy | Ingo Krüger | Linux, BSD, Mac OS X, Windows (Firefox/SeaMonkey addon) | ? | 1.63 | ? |
| Dojo Toolkit | Dojo Foundation | OS-Independent | 2004 | 1.3.2 (2009-7-16) | BSD, AFL |
| MAXA Cookie Manager | Maxa Research | Windows | ? | 3.2 (2009-02-02) | Shareware |
| .minerva | Gabriel Mariani | OS-Independent (Adobe Air) | ? | 3.3.0 (2011-03-27) | BSD |
| PyAMF | Nick Joyce | OS-Independent | 2007-10-07 | 0.6b (2010-08-11) | MIT |
| .sol Editor | Alexis Isaac | Windows | 2005-02 | 1.1.0.1 (2005-02-21) | MPL |
| SOLReader | Alessandro Crugnola | Windows | ? | ? | ? |
| SolVE | Darron Schall | Windows, Mac OS X | 2004-09 | 0.2 (2004-10-15) | CPL |
| s2x | Aral Balkan | OS-Independent | 2005-07-15 | N/A | Freeware |
| Click&Clean | ? | Linux, BSD, Mac OS X, Windows (Firefox/SeaMonkey addon) | ? | ? | ? |
|
||||||||||||||||||||||