From Wikipedia, the free encyclopedia - View original article
Local shared objects (LSOs), commonly called Flash cookies (due to their similarities with HTTP cookies), are pieces of data that websites which use Adobe Flash may store on a user's computer. Local shared objects have been used by all versions of Flash Player (developed by Macromedia, which was later acquired by Adobe Systems) since version 6.
Flash cookies, which can be stored or retrieved whenever a user accesses a page containing a Flash application, are a form of local storage. Similar to that of cookies, they can be used to store user preferences, saved data from Flash games on the computer, and to track users' Internet activity. LSOs have been criticised as a breach of browser security, but there are browser settings and addons to limit the duration of their storage.
Local shared objects contain data stored by individual websites. With the default settings, the Flash Player does not seek the user's permission to store local shared objects on the hard disk. By default, a SWF application running in Flash Player from version 9 to 11 (as of Sept 1, 2011) may store up to 100 kB of data to the user's hard drive. If the application attempts to store more, a dialog asks the user whether to allow or deny the request.
Adobe Flash Player does not allow 3rd-party local shared objects to be shared across domains. For example, a local shared object from "www.example.com" cannot be read by the domain "www.example.net". However, the first party website can always pass data to a third party via some settings found in the dedicated XML file and passing the data in the request to the third party. Also, third party LSOs are allowed to store data by default. By default LSO data is shared across browsers on the same machine. As an example:
This is distinct from cookies which have directory isolated storage paths for saved cookies while LSOs use a common directory path for all browsers on a single machine.
Flash games may use LSO files to store the user's personal game data, such as user preferences and actual game progress. Backing up files such as these requires some technical understanding of software. However, both browser updates and programs designed to remove unused files may delete this data.
To prevent cheating, games may be designed to render LSO files unusable if acquired from another location.
As with HTTP cookies, local shared objects can be used by web sites to collect information on how people navigate them, although users have taken steps to restrict data collection. Online banks, merchants, or advertisers may use local shared objects for tracking purposes.
|“||Cookies or similar devices must not be used unless the subscriber or user of the relevant terminal equipment: ||”|
—Information Commissioner's Office
Local shared objects were the first subject to be discussed in the Federal Trade Commission (FTC) roundtable in January 2010. FTC Chairman Jon Leibowitz has been talking with Adobe about what it describes as "the Flash problem." 
Users can disable local shared objects using the Global Storage Settings panel of the online Settings Manager at Adobe's website. However, this places a permanent flash cookie on the computer, informing all other websites that the user does not want flash cookies stored on their computer. Users can opt out of LCOs from specified sites from Flash Player's "Settings", accessed by right-clicking the Player, or using the Website Storage Settings panel; the latter also allows users to delete local shared objects.
Users may also delete local shared objects either manually or using third-party software. For instance, BetterPrivacy, a Firefox add-on, or CCleaner, a standalone computer program for Microsoft Windows and Mac OS X, allow users to delete local shared objects on demand.
Since version 10.3 of Flash, the Online Settings Manager (letting users configure privacy and security permissions via Adobe's website) is superseded by the Local Settings Manager under the Windows Control Panel, Mac OS System Preferences, Linux KDE System settings or Linux GNOME System > Preferences. Users of other operating systems still use the Adobe Online Settings Manager. Since at least April 2012 (v 18.104.22.168), updating by downloading a new Flash version resets the security and privacy settings to the defaults of allowing local storage and asking for media access again, which may be against users' wishes.
|This section relies too much on references to primary sources. (March 2012)|
Browser control refers to the web browser's ability to delete local shared objects and to prevent the creation of persistent local shared objects when privacy mode is enabled. As for the former, Internet Explorer 8, released on March 19, 2009, implements an API that allows browser extensions to co-operate with the browser and delete their persistent data stored when user issues a Delete Browsing History command. However, two years passed since its introduction until Adobe, on March 7, 2011, announced that Flash Player v10.3, which was still in development at the time, supports co-operating with Internet Explorer 8 or later to delete local shared objects.
Also on January 5, 2011, Adobe Systems, Google Inc., and Mozilla Foundation finalized a new browser API (dubbed NPAPI ClearSiteData). This will allow browsers implementing the API to clear local shared objects. Four months later, Adobe announced that Flash Player 10.3 enables Mozilla Firefox 4 and "future releases of Apple Safari and Google Chrome" to delete local shared objects, so since version 4, Firefox treats LSOs the same way as HTTP cookies - deletion rules that previously applied only to HTTP cookies now also apply to LSOs. This caused loss of data and backward-incompatible flash application behavior for those Firefox and Flash users who used HTTP cookies and Flash local shared objects for different goals. Mainly this had an impact on flash gamers, who rely on Flash LSOs to store saved games. The resulting support requests cannot be solved favorably for Mozilla Firefox users without changes to the browser, because of the introduced equivalence between HTTP and flash cookies. Currently, the workaround in use is to either configure the browser to never clear history data and cookies, or to revert the part of the changes affecting this use case, using third-party patches.
As for the behavior in browser's privacy mode, Adobe Flash Player 10.1, released on June 10, 2010, supports the privacy modes of Internet Explorer, Mozilla Firefox, Google Chrome, and Safari. Local shared objects created in privacy are discarded at the end of the session. Those created in a regular session are also not accessible in privacy mode.
On Mac OS X, they are stored in:
For Linux and Unix systems, if the open-source Gnash plugin is being used instead of the official Adobe Flash, they will instead be found at:
When using Google Chrome the location for the Pepper Flash (PPAPI) storage is:
|Software||Developer||Operating system||Abilities||First public release||Latest stable version||License|
|PrivacyScan||SecureMac.com, Inc.||Mac OS X 10.6 - 10.10||Remove||2012-01-30||1.5||Shareware|
|Cookie Stumbler||WriteIt! Studios Ltd.||Mac OS X 10.8 - 10.9||Remove, Read||2011-04-01||2.1.2||Shareware|
|Cookie||SweetP Productions||Mac OS X 10.6 - 10.7||Remove||2011||3.0.14||Shareware|
|Safari Cookies||SweetP Productions||Mac OS X 10.5 - 10.7||Remove||2009-04-12||1.9.4 (2012-04-05)||Freeware|
|BetterPrivacy||Ingo Krüger||Linux, BSD, Mac OS X, Windows (Firefox/SeaMonkey addon)||Remove, Read AMF0||2008-08-04||1.68 (2012-01-20)||?|
|Dojo Toolkit||Dojo Foundation||OS-Independent||Write AMF0/AMF3 (in browser via Flash)||2004||1.9.0 (2013-05-01)||BSD, AFL|
|MAXA Cookie Manager||Maxa Research||Windows||Remove||?||5.3 (2011-12-11)||Shareware|
|.minerva||Gabriel Mariani||OS-Independent (Adobe Air)||Read AMF0/AMF3, Write AMF0/AMF3, AMF0/AMF3-JSON||~2008-07-15 (1.5.1)||4.0 (2014-09-14)||BSD|
|PyAMF||Nick Joyce||OS-Independent||Read AMF0/AMF3, Write AMF0/AMF3||2007-10-07||0.6.1 (after 2010-08-11)||MIT|
|.sol Editor||Alexis Isaac||Windows||Read AMF0, Write AMF0||Feb. 2005||22.214.171.124 (2005-02-21)||MPL|
|SOLReader||Alessandro Crugnola||Windows||Read AMF0||2007-10-25||1.0.0 (2007-10-25)||?|
|FlashDevelop||Alessandro Crugnola||Windows||Read AMF0/AMF3||2009-06-14 (3.0.0)||4.4.0 (2013-04-18)||MIT|
|SolVE||Darron Schall||Windows, Mac OS X||Read AMF0, Write AMF0||Nov. 2004||0.2 (2004-10-15)||CPL|
|s2x||Aral Balkan||OS-Independent||AMF0-XML, XML-AMF0||Dec. 2003||0.75 (Dec. 2003)||Freeware|
|Click&Clean||Vlad & Serge Strukoff||Linux, BSD, Mac OS X, Windows (Firefox/SeaMonkey addon)||Remove||2010-01-23 (126.96.36.199)||4.1 (2013-03-16)||MIT|
Integration with browser privacy controls for managing local storage – Users will have a simpler way to clear local storage from the browser settings interface – similar to how users clear their browser cookies today.
Representatives from several key companies, including Adobe, Mozilla and Google have been working together to define a new browser API (NPAPI ClearSiteData) for clearing local data, which was approved for implementation on January 5th, 2011. Any browser that implements the API will be able to clear local storage for any plugin that also implements the API.
Change to the "on close" firefox behavior to use the new NPAPI ClearSiteData API.
Change to the "clear recent history" firefox behavior to use the new NPAPI ClearSiteData API.
Loss of data on upgrade bug report, feature request for treating HTTP Cookies and Flash Local Shared Objects differently.
Kongregate discussion about users losing data as a result of the new browser behavior.
Mozilla support question and follow-ups: How do I stop "delete cookies" from deleting saved games of a flash based game?
Third party patch to revert the firefox cookie semantic change