Local shared object

From Wikipedia, the free encyclopedia
"Sol file" and ".sol file" redirect here. For mathematical data format, see Sol (format).

Local shared objects (LSOs), commonly called Flash cookies (due to their similarities with HTTP cookies), are pieces of data that websites which use Adobe Flash may store on a user's computer. Local shared objects are used by all versions of Adobe Flash Player and version 6 and above of Macromedia's now-obsolete Flash Player.[1]

An important use of these types of files is storing save data from Flash games on the user's computer.

While websites may use local shared objects for purposes such as storing user preferences, there have been privacy concerns regarding local shared objects, and they may be considered a breach of browser security.

Storage

Local shared objects contain data stored by individual websites. With the default settings, the Flash Player does not seek the user's permission to store local shared objects on the hard disk. By default, a SWF application running in Flash Player from version 9 to 11 (as of Sept 1, 2011) may store up to 100 kB of data to user's hard drive. If the application attempts to store more data than the allotted default, the user is shown a dialog to allow or deny the request for more storage space.[2]

Adobe Flash Player does not allow 3rd-party local shared objects to be shared across domains. For example, a local shared object from "www.example.com" cannot be read by the domain "www.example2.com".[1] However, the first party website can always pass data to a third party via some settings found in the dedicated XML file and passing the data in the request to the third party. Also, third party LSOs are allowed to store data by default.[3][4] By default LSO data is shared across browsers on the same machine. As an example:

  • A visitor accesses a site using their Firefox browser, then views a page displaying a specific product, then closes the Firefox browser, the information about that product can be stored in the LSO.
  • If that same visitor, using the same machine now opens an Internet Explorer browser and visits any page from the site viewed in Firefox, the site can read the LSO value(s) in the Internet Explorer browser, and display dynamic content or otherwise target the visitor.

This is unique from cookies which have directory isolated storage paths for saved cookies while LSOs use a common directory path for all browsers on a single machine.

Criticism

Many web based Flash games use LSO files to store the user's personal game data, such as user preferences and actual game progress. Backing up files such as these requires a more technical understanding of software, and would be considered by most average users to be a difficult task. However, both browser updates and programs designed to remove unused files may delete this data.

To help combat cheating, game developers may render LSO files unusable if moved or uploaded from another location or backup. This has been criticized, however, as it may cause users to lose data despite backups.

Privacy concerns

As with HTTP cookies, local shared objects can be used by web sites to collect information on how people navigate those web sites even if people believe that they have restricted the data collection.[5] Online banks, merchants, or advertisers may use local shared objects for tracking purposes.[6]

On 10 August 2009, Wired magazine reported that more than half of the top websites used local shared objects to track users and store information about them but only four of them mentioned it in their privacy policy. "Flash cookies are relatively unknown to web users," it said, "even if a user thinks they have cleared their computer of tracking objects, they most likely have not." The article further asserts that some websites use Flash cookies as hidden backups, so that they can revive HTTP cookies when user deletes them.[7]

According to New York Times, since July 2010, there had been at least five class-action lawsuits in the United States against media companies for using local shared objects.[8]

In certain countries, it is illegal to track users without their knowledge and consent. For example, in the United Kingdom, customers must consent to use of cookies/local shared objects:[9][10]

“ Cookies or similar devices must not be used unless the subscriber or user of the relevant terminal equipment:
  • is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
  • is given the opportunity to refuse the storage of, or access to, that information.
 ”

—Information Commissioner's Office

Local shared objects were the first subject to be discussed in the Federal Trade Commission (FTC) roundtable in January 2010.[11] FTC Chairman Jon Leibowitz has been talking with Adobe about what it describes as "the Flash problem." [12]

User control

Users can disable local shared objects using the Global Storage Settings panel of the online Settings Manager at Adobe's website.[13] However, using this feature will permanently place a flash cookie on the user's computer, informing all other websites that the user does not want flash cookies stored on their computer. Users can also opt-out of them on a per-site basis by right-clicking the Flash Player and selecting "Settings" from the popup menu that will appear, or using the Website Storage Settings panel. The latter also allows users to delete local shared objects.[14]

Users may also delete local shared objects either manually or using third-party software. For instance, BetterPrivacy,[15] a Firefox add-on, or CCleaner, a standalone computer program for Microsoft Windows and Mac OSX, allow users to delete local shared objects on demand.

Since version 10.3 of Flash, the Online Settings Manager (letting users configure privacy and security permissions via Adobe's website) is superseded by the Local Settings Manager under the Windows Control Panel, Mac OS System Preferences, Linux KDE System settings or Linux GNOME System > Preferences.[16] Users of other operating systems still use the Adobe Online Settings Manager. Since at least April 2012 (v 11.2.202.233), updating by downloading a new Flash version resets the security and privacy settings to the defaults of allowing local storage and asking for media access again, which may be against users' wishes.

Browser control

Browser control refers to the web browser's ability to delete local shared objects and to prevent the creation of persistent local shared objects when privacy mode is enabled. As for the former, Internet Explorer 8, released on March 19, 2009,[17] implements an API that allows browser extensions to co-operate with the browser and delete their persistent data stored when user issues a Delete Browsing History command.[18] However, two years passed since its introduction until Adobe, on March 7, 2011, announced that Flash Player v10.3, which was still in development at the time, supports co-operating with Internet Explorer 8 or later to delete local shared objects.[19]

Also on January 5, 2011, Adobe Systems, Google Inc., and Mozilla Foundation finalized a new browser API (dubbed NPAPI ClearSiteData). This will allow browsers implementing the API to clear local shared objects.[20] Four months later, Adobe announced that Flash Player 10.3 enables Mozilla Firefox 4 and "future releases of Apple Safari and Google Chrome" to delete local shared objects,[19] so since version 4, Firefox treats LSOs the same way as HTTP cookies - deletion rules that previously applied only to HTTP cookies now also apply to LSOs.[21][22] This caused loss of data and backward-incompatible flash application behavior[23] for those Firefox and Flash users which used HTTP cookies and Flash local shared objects for different goals. Mainly this had an impact on the flash gaming community, which relies heavily on Flash LSOs to store saved games.[24]<ref name="How do I stop "delete cookies" from deleting saved games of a flash based game?>"Mozilla support question: How do I stop "delete cookies" from deleting saved games of a flash based game?". June 2011. Retrieved 2011-09-28. "Mozilla support question and follow-ups: How do I stop "delete cookies" from deleting saved games of a flash based game?" </ref> The resulting support requests cannot be solved favorably for the Mozilla Firefox users without changes to the browser, because of the introduced equivalence between HTTP and flash cookies.[21][22] Currently, the workaround in use is to either configure the browser to never clear history data and cookies, or to revert the part of the changes affecting this use case, using third-party patches.[25]

As for the behavior in browser's privacy mode, Adobe Flash Player 10.1, released on June 10, 2010, supports the privacy modes of Internet Explorer, Mozilla Firefox, Google Chrome, and Safari. Local shared objects created in privacy are discarded at the end of the session. Those created in a regular session are also not accessible in privacy mode.[20][26]

File locations

The default storage location for local shared objects is operating system-dependent, and depends on the flash plugin being NPAPI or PPAPI.

NPAPI

On Microsoft Windows NT 5.x and 6.x, they are stored in:[27]

  • %APPDATA%\Macromedia\Flash Player\#SharedObjects\
  • %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\

On Mac OS X, they are stored in:

  • ~/Library/Preferences/Macromedia/Flash Player/#SharedObjects/
  • ~/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer/sys/

On Linux or Unix, they are stored in:

  • ~/.macromedia/Flash_Player/#SharedObjects/
  • ~/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/

For Linux and Unix systems, if the open-source Gnash plugin is being used instead of the official Adobe Flash, they will instead be found at:

  • ~/.gnash/SharedObjects/

PPAPI

When using Google Chrome the location for the Pepper Flash (PPAPI) storage is:

  • Windows:   %APPDATA%\..\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects
  • MacOS X:   ~/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/#SharedObjects/
  • Linux:       ~/.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/#SharedObjects/

Editors and toolkits

Software Developer Operating system Abilities First public release Latest stable version License
Cookie Stumbler WriteIt! Studios Ltd. Mac OS X 10.8 - 10.9 Remove, Read 2011-04-01 2.0.4 Shareware
Cookie SweetP Productions Mac OS X 10.6 - 10.7 Remove 2011 3.0.14 Shareware
Safari Cookies SweetP Productions Mac OS X 10.5 - 10.7 Remove 2009-04-12 1.9.4 (2012-04-05) Freeware
BetterPrivacy Ingo Krüger Linux, BSD, Mac OS X, Windows (Firefox/SeaMonkey addon) Remove, Read AMF0 2008-08-04 1.68 (2012-01-20) ?
Dojo Toolkit Dojo Foundation OS-Independent Write AMF0/AMF3 (in browser via Flash) 2004 1.9.0 (2013-05-01) BSD, AFL
MAXA Cookie Manager Maxa Research Windows Remove ? 5.3 (2011-12-11) Shareware
.minerva Gabriel Mariani OS-Independent (Adobe Air) Read AMF0/AMF3, Write AMF0/AMF3, AMF0/AMF3-JSON ~2008-07-15 (1.5.1) 3.5.0 (2012-12-13) BSD
PyAMF Nick Joyce OS-Independent Read AMF0/AMF3, Write AMF0/AMF3 2007-10-07 0.6.1 (after 2010-08-11) MIT
.sol Editor Alexis Isaac Windows Read AMF0, Write AMF0 Feb. 2005 1.1.0.1 (2005-02-21) MPL
SOLReader Alessandro Crugnola Windows Read AMF0 2007-10-25 1.0.0 (2007-10-25) ?
FlashDevelop Alessandro Crugnola Windows Read AMF0/AMF3 2009-06-14 (3.0.0) 4.4.0 (2013-04-18) MIT
SolVE Darron Schall Windows, Mac OS X Read AMF0, Write AMF0 Nov. 2004 0.2 (2004-10-15) CPL
s2x Aral Balkan OS-Independent AMF0-XML, XML-AMF0 Dec. 2003 0.75 (Dec. 2003) Freeware
Click&Clean Vlad & Serge Strukoff Linux, BSD, Mac OS X, Windows (Firefox/SeaMonkey addon) Remove 2010-01-23 (3.6.5.0) 4.1 (2013-03-16) MIT

See also

References

  1. ↑ 1.0 1.1 "What are local shared objects?". Security and privacy. Adobe Systems. Retrieved 2007-12-05. 
  2. ↑ "ActionScript Documentation Reference for Adobe Flash Platform". Adobe Systems. 2011-08-22. Retrieved 2011-09-02. 
  3. ↑ "What Are Third-Party Local Shared Objects?". Security and privacy. Adobe Systems. Archived from the original on 2010-05-29. Retrieved 2011-08-15. 
  4. ↑ "How to disable third-party local shared objects". Support. Adobe Systems. Retrieved 2011-08-15. 
  5. ↑ Kirk, Jeremy (2009-08-11). "Adobe Flash cookies pose vexing privacy questions". Network World (Network World, Inc). IDG News Service. Retrieved 2009-04-10. 
  6. ↑ Cohn, Michael (2005-03-15). "Flash Player Worries Privacy Advocates". InformationWeek (UBM Techweb). Retrieved 2007-12-05. 
  7. ↑ Singel, Ryan (2009-08-10). "You Deleted Your Cookies? Think Again". Wired (Condé Nast Digital). Retrieved 2009-08-22. 
  8. ↑ Vega, Tanzina (2010-09-21). "Code That Tracks Users’ Browsing Prompts Lawsuits". New York Times (The New York Times Company). Retrieved 2011-05-05. 
  9. ↑ "Part 2: Security, confidentiality, traffic and location data, itemised billing, CLI and directories" (PDF). Guidance on the Privacy and Electronic Communications (EC Directive) Regulations 2003 (3.4 ed.). United Kingdom: Information Commissioner’s Office. 2006-11-30. Retrieved 2011-05-05. 
  10. ↑ "Confidentiality of communications". Guide to the Privacy and Electronic Communications Regulations. United Kingdom: Information Commissioner’s Office. Retrieved 2011-05-05. 
  11. ↑ James Temple (2010-01-29). "All eyes on online privacy". San Francisco Cronicle. Retrieved 11 February 2011. 
  12. ↑ Donald Melanson (2010-12-04). "FTC says it's talking to Adobe about the problem with 'Flash cookies'". Engadget. Retrieved 11 February 2011. 
  13. ↑ "Global Storage Settings panel". Flash Player Help. Adobe Systems. 2009-07-14. Retrieved 2011-05-05. 
  14. ↑ "Website Storage Settings panel". Flash Player Help. Adobe Systems. 2009-07-14. Retrieved 2011-05-05. 
  15. ↑ Guarino, Joseph (2010-03-12). "Seven Firefox add-ons that improve online privacy". Macworld. Mac Publishing, LLC. Retrieved 2010-05-24. 
  16. ↑ "Adobe - Flash Player : Settings Manager". Flash Player Help. Adobe Systems. 2012-04-14. Retrieved 2012-04-14. 
  17. ↑ "Microsoft Announces Availability of Internet Explorer 8". PR Newswire (Redmond, Washington: PR Newswire Association LLC). 2009-03-19. Retrieved 2011-05-05. 
  18. ↑ "Deleting "Flash Cookies" Made Easier". IEBlog (Microsoft Corporation). TechNet Blogs. 2011-05-03. Retrieved 2011-05-05. 
  19. ↑ 19.0 19.1 Imbert, Thibault (2011-03-07). "Introduced Flash Player 10.3 beta!". Adobe AIR and Adobe Flash Player Team Blog (Adobe Systems). Adobe Blogs. Retrieved 2011-05-05. "Integration with browser privacy controls for managing local storage – Users will have a simpler way to clear local storage from the browser settings interface – similar to how users clear their browser cookies today." 
  20. ↑ 20.0 20.1 Huang, Emmy (2011-01-12). "On Improving Privacy: Managing Local Storage in Flash Player". Adobe Flash Platform Blog (Adobe Systems). Adobe Blogs. Retrieved 2011-05-05. "Representatives from several key companies, including Adobe, Mozilla and Google have been working together to define a new browser API (NPAPI ClearSiteData) for clearing local data, which was approved for implementation on January 5th, 2011. Any browser that implements the API will be able to clear local storage for any plugin that also implements the API." 
  21. ↑ 21.0 21.1 Mike Beltzner (2011-01-13). "Bugzilla entry 625495 - Clear Adobe Flash Cookies (LSOs) when Clear Cookies is selected in the Privacy > Custom > Clear History". Retrieved 2011-09-28. "Change to the "on close" firefox behavior to use the new NPAPI ClearSiteData API." 
  22. ↑ 22.0 22.1 Mike Beltzner (2011-01-13). "Bugzilla entry 625496 - Clear Adobe Flash Cookies (LSOs) when Cookies is selected in Clear Recent History". Retrieved 2011-09-28. "Change to the "clear recent history" firefox behavior to use the new NPAPI ClearSiteData API." 
  23. ↑ Claudio Fontana (2011-07-17). "Bugzilla entry 672107 - Add configuration option to treat web cookies and flash shared local objects (LSOs) differently; destructive upgrade from older Firefox versions". Retrieved 2011-09-28. "Loss of data on upgrade bug report, feature request for treating HTTP Cookies and Flash Local Shared Objects differently." 
  24. ↑ "All my saved games are gone". 2011-06-30. Retrieved 2011-09-28. "Kongregate discussion about users losing data as a result of the new browser behavior." 
  25. ↑ Claudio Fontana (2011-07-11). "firefox flash LSO revert patch". Retrieved 2011-09-28. "Third party patch to revert the firefox cookie semantic change" 
  26. ↑ Betlem, Paul (2010-06-10). "Flash Player 10.1 Now Available for Windows, Mac, and Linux". Adobe AIR and Adobe Flash Player Team Blog (Adobe Systems). Adobe Blogs. Retrieved 2011-05-07. 

External links

File formats
Software
Viewers
Authoring tools
Server-side software
Related topics
This article is issued from Wikipedia. The text is available under the Creative Commons Attribution/Share Alike; additional terms may apply for the media files.