Local Shared Objects (LSO) - Flash Cookies

Local Shared Objects (LSO), commonly called flash cookies, are collections of cookie-like data stored as a file on a user's computer. LSOs are used by all versions of Adobe Flash Player and Version 6 and above of Macromedia's now-obsolete Flash MX Player.

Privacy concerns

LSOs can be used by web sites to collect information on how people navigate those web sites even if people believe they have restricted the data collection. More than half of the internet’s top websites use LSOs to track users and store information about them. There is relatively little public awareness of LSOs, and they can usually not be deleted by the cookie privacy controls in a web browser. This may lead a web user to believe a computer is cleared of tracking objects, when it is not.




Several services even use LSOs as surreptitious data storage to reinstate traditional cookies that a user deleted, a policy called "re-spawning" in homage to video games where adversaries come back to life even after being "killed". So, even if a user gets rid of a website’s tracking cookie, that cookie’s unique ID will be assigned back to a new cookie again using the Flash data as "backup.

User control

Local Shared Objects are not temporary files. Users can only opt-out of Local Shared Objects globally by using the Global Storage Settings panel of the online Settings Manager at Adobe's website. Users can also opt-out of them on a per-site basis by right-clicking the Flash player and selecting 'Settings'.

Adobe's online-only Website Storage Settings panel was created to let users view and delete LSOs on a per-domain basis. It is also possible to completely disallow LSOs from a specific domain by setting the storage space to "0 KB", however, although no data is stored, empty directories with the name of the domain are nonetheless created. Add-on extensions that allow the user to view and delete LSOs have also been created for the Firefox Web browser, e.g. BetterPrivacy.


File Locations


The default storage location for LSO files is operating system-dependent. LSO files are typically stored with a ".SOL" extension, within each User's directory. Note that for self-executing flash applications run on the local machine will show up as being run on a website, in the folder localhost.

• Windows XP:
  
  •  %APPDATA%\Macromedia\Flash Player\#SharedObjects\\\\
  •  %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys
  • C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\filename.sol
  • C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\[alpha-numeric folder name]\filename.sol
  • C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\filename.sol
  • C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\\filename.sol
  • C:\Documents and Settings\\Application Data\Macromedia\Flash Player\#SharedObjects\\filename.sol
  • C:\Documents and Settings\\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\filename.sol
  • C:\WINDOWS\system32\Macromed\[subdirectories]\filename.sol
  • For AIR Applications: %APPDATA%\\Local Store\#SharedObjects\.swf\
• Windows Vista and later:
  
  • For Web sites: %APPDATA%\Macromedia\Flash Player\#SharedObjects\\\\
  • And also: %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys
  • For AIR Applications: unknown, likely similar to the above
• Mac OS X:
  
  • For Web sites: ~/Library/Preferences/Macromedia/Flash Player/#SharedObjects////
  • For AIR Applications: ~/Library/Preferences//Local Store/#SharedObjects/.swf/
• Linux/Unix:
  
  • ~/.macromedia/Flash_Player/#SharedObjects////.swf/

° - Flash player can save the file in any path specified by the SWF developer, relative to the current domain.


Programming


The Flash Player allows Web content to read and write LSO data to the computer's local drive on a per-domain basis; such data may preserve session state and record user data and behavior.
By default, a Flash application may store up to 100kb of data to user's hard drive (browser cookies have a limit of just 4kb). The defined storage sizes are 0kb, 10kb, 100kb, 1Mb, 10Mb, and Unlimited. If the current limit is exceeded, the user is shown a dialog requesting storage space of the next size. The user may override the amount manually by clicking the Flash application with right mouse button and selecting Settings; however, this applies only to the domain of the Flash movie. If the selected setting is smaller than the current data size, the data is deleted.
Global LSO settings are not under the direct control of the user, and can only be amended through Adobe's online "Global Settings Manager" control panel.

Editors and toolkits

Software	Website	Developer	First public release	Latest stable version	Cost (USD)	Open source	License	Programming language
SolVE	SolVE	Darron Schall	2004-09	0.2 (2004-10-15)	Free	Yes	CPL	Java
.sol Editor	.sol Editor	Alexis Isaac	2005-02	1.1.0.1 (2005-02-21)	Free	Yes	MPL	ActionScript, Delphi/Kylix
Dojo Toolkit	Dojo Toolkit	Dojo Foundation	2004	1.3.2 (2009-7-16)	Free	Yes	BSD, AFL	JavaScript
MAXA Cookie Manager	MAXA Cookie Manager	Maxa Research	?	3.2 (2009-02-02)	Non-free 35	No	proprietary	?
PyAMF	PyAMF	Nick Joyce	2007-10-07	0.6b (2010-08-11)	Free	Yes	MIT	Python
SOLReader	SOLReader	Alessandro Crugnola	?	?	Free	No	?	C#, PHP [15]
s2x	s2x	Aral Balkan	?	?	Free	Yes	?	Python [16]
.minerva	coursevector.com	Gabriel Mariani	?	3.2.3 (2010-06-11)	Free	Yes	?	AIR

Operating system support

Software	Windows	Mac OS X	Linux	BSD	Unix
SolVE	Yes	Yes	No	No	No
.sol Editor	Yes	No	No	No	No
Dojo Toolkit	Yes	Yes	Yes	Yes	Yes
MAXA Cookie Manager	Yes	No	No	No	No
PyAMF	Yes	Yes	Yes	Yes	Yes