Does the Flash Player store things in my computer? Is that safe?

Macromedia Flash (long since purchased by Adobe) has exploded in the web as
the platform-independent dynamic content player of choice. If you’ve ever
watched a video on YouTube (and who hasn’t?), you used the Flash Player to do
it.

What many people don’t realize is that, yes, Flash can store information in
on your computer for the site you’re visiting.

You’ve heard of “cookies“,
as used by your internet web browser? There’s a new term in town: flash
cookies.

]]>

The problem with information stored by flash player is not only do most people not realize that the information is stored at all, but it’s also not obvious how to clear it, or prevent it.

While the information stored by Flash Player is very much like browser cookies – the information is made available to the site that put it there in the first place – it’s not related to your browser in any way. Clearing your browser’s cache, cookies or other information will not clear the information stored by Flash.

You can control Flash Player’s behaviour with respect to the data it stored by visiting the Flash Settings Manager, which is not surprisingly a Flash application on the Macromedia/Adobe web site. There you can visit the “Global Storage Settings Panel” to control how Flash should deal with local storage:

Here you can control how much space is used, or whether applications are even allowed to store information on your computer at all. (It’s worth visiting the other tabs in the Setting Manager. They’ll let you control content on a site by site basis, as well as other privacy and security settings.)

So, what’s the risk?

In my opinion the risk is very similar to browser cookies – in other words, not much.

There’s little to no security risk, as stored information is just that, stored information and nothing more. Barring unpatched vulnerabilities in Flash or your system, this stored data cannot be used to spread malware or infect your system.

The risk, to the extent that it exists, is one of privacy. Much like browser cookies, Flash information can be used to remember the sites you’ve visited (if they, or their advertising networks use Flash), and perhaps even what you’ve done while on that site. (Typically, again like browser cookies, the stored Flash information is really just used to remember your settings and choices for you.)

I don’t see this as a huge issue. As I’ve said repeatedly, you, as an individual, just aren’t that interesting. No one cares what you do. What they care about, perhaps, is finding out that 1,000 people like this site, and 2,000 like this other site, and other types of “aggregate” information. Exactly who those 1,000 or 2,000 people are is lost when the information is collected.

But of course not everyone feels the same way.

The other side of the issue is that, as you’ve seen, some applications simply require the ability to store information and won’t work if they can’t. That’s simply a decision you’ll need to make as you visit sites that use Flash.