Flash cookies are a threat to privacy

13th November 2008 by David North

I’m not an overly paranoid person and think some of the people who feel the need to delete their cookies regularly are probably taking things just a little too far. If people are tracking me around the web and serving adverts I might actually be interested in - fair play to them! I have nothing to hide and nothing to worry about.

However I didn’t realise that Flash provides a much more dangerous type of cookie that really needs to be addressed.

This Local Shared Object can:

  • Stay on your computer for an unlimited amount of time
  • Store 100 kb of data by default, with an unlimited max
  • Couldn’t be deleted by your browser
  • Send previous visit information and history, by default, without your permission

The big thing I take exception to here are the last two points. Firstly I believe every technology should give the user the ability to opt out, for cookies the option to delete should be readily available even if for the most part it’s only used by a minority. But the second point is truly wrong - this kind of data should be limited as it is in other technologies such as JavaScript.

Come on Adobe just give an opt out button on the next version of Flash player or perhaps just make security settings a little easier to find for your average user?

Steve Jobs is dead!

4th October 2008 by David North

Well he isn’t actually but it’s a similar sort of headline that was taken seriously and reported by CNN. It would seem a blog reported Mr Jobs (High godness of Apple) had a heart attack and CNN broadcast this causing a drop in Apple’s share price.

A little bit irresponsible of CNN not to get this confirmed after all don’t believe everything you read online. It would also seem there are investigations to see if this story was published with the intention of pushing down the share price.

When good ideas aren’t thought through part 2

4th August 2008 by David North

I’m all for advances in technology to protect users but why do some companies seem to handle things so clumsily and just not think how it is going to affect the end users? Sometimes these actions can actually be damaging to other trading companies.

I have two examples of just this happening today.

Firstly with regard to Mozilla rolling out a new policy when it comes to SSL certificates (this will be within Firefox 3). Essentially if you self certify or get an unapproved provider to sign the certificate any users of Firefox 3 will get a massive scary message - the kind that most people have a little panic and push the back button.

Mozilla are trying to do the right thing but in too bullish a way. If a certificate is actually invalid this of course should be displayed but if it is simply by an unapproved provider an alternative message should be provided.

In the case of SSL certificates they are provided for two reasons.

  1. To encrypt data sent to and from the server.
  2. To authenticate the website is what it says it is.

The second point can only be trusted when a third party reputable provider issues the certificate and this is what Firefox is trying to protect against. Why not have a bit more user friendly message that explains that? If a self certified certificate is being used simply to ensure secure transfer of data strictly speaking the certificate is not invalid so why say it is?

My second annoyance is with McAfee and their SiteAdvisor system they have in their security software. Every McAfee’s users’ search engine results pages have icons put next to each result to signify if McAfee has tested if the site as safe or not.

Sounds like a good idea yes? Certainly gives piece of mind for the average user however if as a company you are unlucky enough still to be in McAfee queue for testing websites it’s not such good news.

If a user is confronted with a red cross next to a search result (failed McAfee’s tests) you’d understand people avoiding it like the plague but how about if they have a yellow exclamation mark next to them?

Well for the average users they too would avoid this like the plague - why take the risk?

So when a company I’ve been working with had this very problem (and notably their competitor’s have already been awarded the magic green tick) I contacted McAfee to see if they could move things along. A brick wall is about the best description - wait your turn. Hardly the response you want when an action by another company could actively be turning away paying customers.

I’m not saying that McAfee shouldn’t have come up with this solution just the implementation is lacking. Surely a more carefully categorised queuing system could have ensured no uneven roll-out through competitors? Or maybe if such a thing was to happen there could be conditions when a website could be fast tracked?

Is software all about image now?

29th July 2008 by David North

I’ve spoken quite a few times about people’s different perceptions of companies and how it can effect how they view future actions the company makes.

A simple example of this is the launch of Microsoft Windows Vista which was met with a luke-warm reception and condemnation when Microsoft started trying to phase out Windows XP.

I’ve been running on Vista for quite some with only a few small quibles which for a new operating system I don’t think is so bad. However people’s perception of Vista is “another Windows ME” which is unfounded in my opinion. Many haven’t even tried Vista due to the negative image.

So rather than sitting back Microsoft came up with a clever idea to at least attempt to show Vista isn’t so bad. The Windows ‘Mojave’ project recruited people who had a low perception of Vista but no actual experience of it. The project was to trial a new version of Windows or so the group thought. In actual fact they were test driving Vista and the results were very positive.

So why the negative image? It’s Microsoft of course! Some people would rather eat their own children than acknowledge Microsoft have done anything right?

Is Vista worth shouting home about? Hmm I wouldn’t say it was a ground breaking as I was hoping. It’s built on the steady structure of XP (although built from the ground up if you believe Microsoft) and with Microsoft’s goals of higher security it’s been beefed up using a more resilient security model. However another layer of security they’ve added is actually my main gripe with it. Showing users warnings about programs trying to access certain resources doesn’t work. The main users on Vista won’t even understand what it means! I’ve disabled UAC myself because it’s just so annoying!

Vista search is great, the interface is much slicker and I’ve never had a full system crash as yet - if they happen it’s at an application level and rare.

When Windows XP was launched it was squarely slagged off too - “Windows with crayons” because of the default theme but now it’s recognised as a good OS by most. This of course is partly due to Microsoft’s attitude to getting patches and upgrades out quickly when needed - which other software companies need to follow.

Of course there are also select companies that will receive positive receptions even before the product is launched to name Apple for one (I really wanted to avoid the Apple / Microsoft comparison but it’s the most obvious).

I myself try to be as unbiased as possible when it comes to any product - although I have to admit I probably do have a more PC / Microsoft stance just due to my background. I’ve also mentioned that some of the supporters of technologies have also led me to have a more cynical attitude to these products. Does this make me the exact opposite of the what seems to be the majority of people? Is it just image that seems to matter now?