Firm Exploits Flash to Restore Deleted Cookies

[rogerd]

Are you one of the many web surfers who deletes cookies on a regular basis to avoid tracking by marketers and others? Well, those nosy marketers have found a way to fight back:
[internetweek.com...]

By tagging your browser with a Flash object containing a unique ID, United Virtualities can recognize an individual PC and restore the deleted cookie data. Flash allows "shared objects" to be saved on the PC, which some clever person deduced could be an alternate form of unique identification.

Pretty soon you'll have to reformat your hard drive every week or so just to be sure...

[whoisgregg]

Excellent post, MrMiles.

So, at the end of the day, you still have to trust the issuer of the Shared Objects

Which really means the issuers need to build that trust. Macromedia needs to do a better job of providing users the means to decide who they get to trust.

Considering the mechanism of removing Shared Objects requires a visit to the Macromedia website, that says to me that "macromedia.com" is a defacto trusted domain for managing all domains shared objects. That also implies that a SWF file running from macromedia.com can read any and all shared objects on my machine.

Each user's computer should be the only entity trusted to manipulate files across different domains, not Macromedia.

[tedster]

Considering that Flash is proprietary technology, is Macormedia responsive to any standards body? EMCA, W3C?

[dsandall]

Considering that Flash is proprietary technology, is Macormedia responsive to any standards body? EMCA, W3C?

I do believe that Macromedia opened up the swf file format a few years ago, which led to programs like Swish. The Flash app itself is of course closed off, but not the end product.

Dwayne

ps. Not to start a big debate here, but I noticed a few comments in this thread about 'respecting the user by not using cookies or javascript'. I have been working in the interactive world since 1990, first with Hypercard, then Director, HTML (php/sql too) & Flash, and I have continuously heard statements like that, and I've never heard anyone give me the logical backing to them, it seems like a religion and I just want to understand the rationale for that sort of thinking.

If you go back to one of the earlier posts giving the examples of the benefits of cookies (ie. amazon) or the flash bits (high scores, etc) how do those dis-respect the user? Of course there is always the negative potential of any tech.

Again, I'm not trying to start/instigate any flame war, I just want to understand.

Dwayne

[whoisgregg]

respecting the user by not using cookies or javascript

I think most of us aren't saying "don't use them" but are taking the stance that transparency and control of the information that is retrievable by a website about the user is important.

[dsandall]

respecting the user by not using cookies or javascript

I think most of us aren't saying "don't use them" but are taking the stance that transparency and control of the information that is retrievable by a website about the user is important.

That's what I was trying to get to understand, the ethics of the use of the technology, not the technology itself. I struggle with blanket statements that equate technology to the ethics of it without considering the good, just assuming that one (or a few) bad consequence makes the technology 'bad'. Any technology from agriculture to web cookies can be taken as good or bad depending on the arguement (and the context) you make.

As to the transparency issue, that is of absolute importance. For example, when having a 'remember me' function when logging in, requires an 'about this feature link' to explain how and why. I know if that is on a site I design, the cookie data is a md5 hash of a user code (not a user id or password) that is totally meaningless to anyone but the code on the site. To me this practice does not show 'disrespect' to the user, as it is offering them a choice (of course if someone can explain to me how it would be so, I'm open to the discussion). So when I see the blanket statements, it invokes me to understand the rationale for them.

I think there needs to be an open dialogue about the ethics of these technologies, and we, as professionals, have to be open about what it is that we do 'behind the scenes' on sites. Just because there have been some rotten apples doing no good with cookies (or even the naive not understanding the implications of their coding practices) we can't lump them all together as bad.

Thanks for the discussion on this,
Dwayne