Flash cookies: new threats to Internet Privacy

For sites and advertisers, through HTTP cookies to obtain information is not under way are welcome. Now users have found ways of avoiding them. According 布鲁斯施奈尔 news, site developers now have a better way. Although it is still seen as a Cookie, but it is different.

LSO, a bigger and better cookie

Under similar HTTP cookie, the local shared object (LSO) or call Flash cookie is stored on our information and track activities on the Internet way. On this project, I understand the information are:

· Flash cookie can accommodate up to 100 kilobytes of data, and a standard HTTP Cookie is only 4 kilobytes.

· Flash cookie expiration time is not the default.

· Flash cookie will be stored in different locations, making them difficult to find.

YouTube's Test

LSO is also very difficult to remove. An example can be shown here. Visit the YouTube site, open a video, adjust the volume. Delete all cookies and close the Web browser. Re-open the web browser and play the same video. Please note that sound does not revert to default settings. This proves that Flash cookie has not been removed, also play a role.

Very few people know the existence of Flash cookies, so this is a problem. It makes those cookies on the Web browser to control user access to a false sense of security. As mentioned above, privacy controls will not affect the Flash cookies.

Where they are stored in

Flash cookies used. Sol extension. But even know this, I still can not find any on my computer there is a sign. Thank you, Google (using Flash cookies), I found information about Flash cookies only way the website is Flash player.

The following pictures from the Flash player, site, showing the storage area settings. Label is displayed visited the site (total 200), all save the location of Flash cookies. If you want to delete the words of the label is also the location of such operations.


Flash cookies very popular

Another of Google search results brought me to a University of California at Berkeley study. Researchers on the top 100 sites in the Flash cookies and privacy applications to conduct the survey. The results showed:

* 100 sites in 54 using Flash cookies.

* This site uses 54 157 Flash cookies, produced a record 281 individuals Flash cookies.

* 100 sites in 98 using HTTP cookies. This web site produced 98 3602 HTTP cookies record.

* 31 of these sites use the TRUSTe privacy program logo. 31 of 14 applications had Flash cookies.

* 100 sites, only four use Flash as a tracking mechanism.

It appears that many sites use both HTTP and Flash cookies. It was very confusing to the researchers. After extensive analysis, they find out the reason, rebirth (respawning).

Flash cookie rebirth

University of California, Berkeley, researchers found that the time you close the browser HTTP cookies can be removed using Flash cookie information in the rewrite (born again):

"We found several web site was rewritten HTTP cookie situation. At About.com on a SpecificClick Flash cookie rewrite a deleted SpecificClick HTTP cookie. The same situation occurs in the Hulu.com on a QuantCast Flash cookie rewrite a deleted QuantCast HTTP cookie. "

The researchers also found that Flash cookies can be restored, and is not limited to the same domain of HTTP cookies:

"We also found that cross-domain HTTP Cookie can be rewritten. For example, third-party ClearSpring the Flash cookie can override Answers.com meet the requirements HTTP cookie. ClearSpring also can override the requirements found Aol.com and Mapquest.com HTTP cookies. "

Its function become more powerful

Not long ago, Google started to use them that they would not use behavioral targeting (BT) technology, I have written an article. In the article, I mentioned that online advertising to promote Association (NAI). About 30 companies using BT technology. Under pressure, the association created a opt-out page, to avoid being tracked becomes very simple.

The researchers found that, cookie out of the settings are incomplete. NAI's sites are created the Flash cookies. The report mentioned a specific event:

"We found that NAI QuantCast the cookie set on withdrawal, Flash cookies still in use. In the cookies are deleted, Flash cookie also allows rewrite QuantCast HTML cookie. It does not choose to rewrite the exit Cookie. Therefore, users select After the track is still out there. "

Some solutions

In order to avoid save Flash cookies, on the need to use the Global Storage Settings Manager to enter setup options, as shown below to remove the "allow third-party Flash content stored on your computer" option.


In this case, we can avoid Flash cookies are installed into the system. The irony is that we must accomplish this in the Flash site operation.

In tests, researchers used the Mozilla Firefox browser. In the report, they mentioned a Firefox plug-BetterPrivacy, you can turn off the time to delete all flash cookies. The other plug-ins can Ghostery network to track the hidden script, and issued a warning.

Conclusions

I think that being anonymous on the Internet to track the time has passed. If this technology really is harmless, please join the consent of the options.

轉自 Softcov

0 意見: