Flash Cookies

[aceman]

Hy everybody,

Because i use BetterPrivacy extension I didn't even realize that
Firefox don't have really any ways to deal with Flash Cookies and how
important that is. Imagine user surfing in an internet caffe, he can't
install any extension but with FlashCookieControl build into Firefox
itself he would be able to surf truly in private manner if he chose
so.
I think this is very important especially when users wants to surf in
private mode, and I believe it can be relay beneficial to the user.
Therefore i think that this is worth to think of about putting some
kind of control over this into firefox.next, what do you think?
I think that firefox(or for that matter any browser) in private
browsing and without this integration it's not really private anymore.

regards

[Mike Beltzner]

On 12/2/2009 8:47 AM, aceman wrote:
> I think this is very important especially when users wants to surf in
> private mode, and I believe it can be relay beneficial to the user.
> Therefore i think that this is worth to think of about putting some
> kind of control over this into firefox.next, what do you think?

We agree, but it's not clear that Firefox can offer a reliable solution
as Adobe (or other plugin providers) may choose to change how and where
they store cookies or similar client side data as they release new
versions. At best this would result in a situation no better than what
we have now, but at worst this could result in Firefox becoming
incompatible with a plugin update in a way that causes a file system
error or crash.

Bug 290456 was filed on this particular issue, and in comment 22 [1] we
were asked by the Adobe project lead to provide an event that plugins
could listen for that would request that they clear their cookies and
client side data storage. That work is being tracked in bug 508167 [2].

Private Browsing mode already exposes its status and transitions through
NPAPI [3], and there are events for add-ons to listen to, as well.

> I think that firefox(or for that matter any browser) in private
> browsing and without this integration it's not really private anymore.

We agree, and are continuing to work with plugin vendors to provide them
the information to behave appropriately in those situations. Best of
all, other browsers using NPAPI (like Chrome) will be able to benefit
from this work, as well!

cheers,
mike

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=290456#c22
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=508167
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=468877

[aceman]

Thanks Mike. Didn't know that there is already an initiative around
this. I'm really glad to see a progress on this.

Interesting is that bug 290456 is from 2005 and we still don't have
solutions for this :)
And I agree it's not maybe as trivial as it seems at first. As you
said and I agree again that the best way is to expose an api and then
wait for the plug-in vendors to implement the rest.

regards

[Mike Beltzner]

On 2009-12-02, at 10:22 AM, aceman wrote:

> And I agree it's not maybe as trivial as it seems at first. As you
> said and I agree again that the best way is to expose an api and then
> wait for the plug-in vendors to implement the rest.

Well, that and pressure from the community.

cheers,
mike

[FP]

Flash 10.1 beta respects Firefox's private browsing mode and doesn't
write cookies while the browser is in that mode. So there is a
solution if you're willing to run pre-release software, see their
release notes for details:

http://labs.adobe.com/technologies/flashplayer10/releasenotes.pdf

It seems to work fine in my (albeit) limited testing.