Original URL: http://www.theregister.co.uk/2011/01/13/deleting_flash_cookies/

Adobe (finally) makes it easier to delete Flash cookies

Privacy menace made manageable

By Dan Goodin

Posted in Security, 13th January 2011 05:00 GMT

Adobe has finally fixed a privacy weakness that threatened users of its ubiquitous Flash Player: the software's storing of cookie-like files that many websites used to track visitors' behavior against their wishes.

So-called LSOs, or local shared objects, are useful for storing user preferences, such as the preferred sound volume when visiting YouTube, but the Flash feature comes with a dark side. Unscrupulous websites can use them to restore tracking cookies even after a user deliberately deletes them. Files that do this have come to be known as Flash cookies.

Now, developers at Adobe have worked with their counterparts at Mozilla and Google on a programming interface that allows LSOs to be deleted from within the settings panel of compliant browsers. The API, known as NPAPI ClearSiteData, has already been approved for implementation in Firefox. It will soon appear on the Google Chrome dev channel.

Emmy Huang, a Flash Player group project manager who blogged about the change, didn't say if Microsoft or Apple planned to add the feature to Internet Explorer and Safari.

Huang also announced changes that add more LSO control to the Flash Player Settings Manager. The panel allows users to turn off LSO storage altogether, or to customize which sites can or cannot use the feature.

The Flash revamp comes some 17 months after US academics found that a more than 50 percent of websites sampled used LSOs to track their users. They warned the use of Flash cookies threatened user privacy because they were often overlooked and harder to delete. Last year, Walt Disney's internet subsidiary and several of its partners were sued for allegedly using Flash cookies to track highly personal information about their users, many of whom were minors. ®