<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>without-brains.net &#187; Web</title>
	<atom:link href="http://www.without-brains.net/archives/tag/web/feed" rel="self" type="application/rss+xml" />
	<link>http://www.without-brains.net</link>
	<description>A software developer&#039;s blog</description>
	<lastBuildDate>Thu, 17 Jun 2010 17:34:33 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Is your browsing behavior being tracked?</title>
		<link>http://www.without-brains.net/archives/74</link>
		<comments>http://www.without-brains.net/archives/74#comments</comments>
		<pubDate>Sat, 21 Nov 2009 10:29:20 +0000</pubDate>
		<dc:creator>Mark</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Web]]></category>

		<guid isPermaLink="false">http://www.without-brains.net/?p=74</guid>
		<description><![CDATA[After reading about the topic of my previous post (your browser history not being secure), I decided to take a look at the various security plugins that you can get for Firefox (my browser of choice). I came across the plugin BetterPrivacy that referenced Local Shared Objects (or LSO).
LSO are basically Flash cookies (some people [...]]]></description>
			<content:encoded><![CDATA[<p>After reading about the topic of my previous post (your browser history not being secure), I decided to take a look at the various <a title="Firefox security plugins" href="https://addons.mozilla.org/en-US/firefox/browse/type:1/cat:12?sort=popular">security plugins</a> that you can get for <a title="Firefox" href="http://en-us.www.mozilla.com/en-US/firefox/personal.html">Firefox</a> (my browser of choice). I came across the plugin <a title="BetterPrivacy Firefox plugin" href="https://addons.mozilla.org/en-US/firefox/addon/6623">BetterPrivacy</a> that referenced <a title="Wikipedia article on LSO" href="http://en.wikipedia.org/wiki/Local_Shared_Object">Local Shared Objects</a> (or LSO).</p>
<p>LSO are basically <a title="Adobe Flash player" href="http://get.adobe.com/flashplayer/">Flash</a> cookies (some people call them super-cookies), and from what I have read any Flash app that gets loaded (including those annoying adds you get everywhere, or perhaps a hidden app that you don&#8217;t even see) can store a set amount of data on your hard drive (the default is 100k). <span id="more-74"></span>When you clear your browser&#8217;s temporary files the LSO don&#8217;t get deleted, in fact there&#8217;s nothing in your browser settings that can get rid of them! On an app by app basic you can (sometimes) access the settings through the context menu (right clicking on the app) which allows you to configure the amount of data that particular app can store&#8230; setting that to 0k will stop it from storing anything. Of course when a website has an &#8220;invisible&#8221; Flash app for the purpose of tracking you, you have no way of knowing about it</p>
<p>So what can you do to prevent this from biting you in the ass, while still being able to run Flash apps?</p>
<p>If you use Firefox (which I really recommend) you can start by installing the <a title="NoScript" href="https://addons.mozilla.org/en-US/firefox/addon/722">NoScript</a> plugin. This plugin by default disables all Javascript and plugins (such as Flash and Java). You can enable Javascript on a domain basis, which in practice you should then only allow domains you trust (basically the sites that you visit from which you require the Javascript functionality to work, and that you don&#8217;t expect to act shadily). You can even take it a step further, in the NoScript options you can configure the addon to ensure that even for whitelisted sites (domains that you have enabled) the embedded apps do not run automatically. When you do need to run one of these Flash apps you can simply click on the app to temporarily activate it. If you do this all, then those hidden Flash apps won&#8217;t ever run <img src='http://www.without-brains.net/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
<p>So what else can you do? Adobe offers a website that you can use to change the global settings of the Flash player plugin: <a title="Flash player plugin global settings" href="http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html">http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html</a>. With the global settings manager you can configure that by default a Flash app may not store anything on your hard drive, when you do have a Flash app for which you want to enable this (perhaps an online game that you play which stores your progress on your hard disk, or something similar) then you can right click on that app and change the settings for that particular domain. Additionally you can use the Flash player global settings manager to delete whatever LSO you already have on your system (to clean up whatever garbage you have collected up to this point in time).</p>
<p>If you are running Firefox you can in addition to the above also install the earlier mentioned BetterPrivacy addon if you like, although I am not certain if that is necessary if you have already installed NoScript, configured it to disallow all embedded apps unless specifically enabled and set the global Flash settings ad described above.</p>
<p>If you apply the above on your system you should have reasonable protection against LSO abuse <img src='http://www.without-brains.net/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://www.without-brains.net/archives/74/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Think your browser history is safe? Think again!</title>
		<link>http://www.without-brains.net/archives/72</link>
		<comments>http://www.without-brains.net/archives/72#comments</comments>
		<pubDate>Sat, 21 Nov 2009 05:33:01 +0000</pubDate>
		<dc:creator>Mark</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Web]]></category>

		<guid isPermaLink="false">http://www.without-brains.net/?p=72</guid>
		<description><![CDATA[So you think your browser history is yours right? And that no visiting website can see that&#8230; think again! Go to http://startpanic.com, test your browser and sign the petition!
]]></description>
			<content:encoded><![CDATA[<p>So you think your browser history is yours right? And that no visiting website can see that&#8230; think again! Go to <a title="Start panic!" href="http://startpanic.com/">http://startpanic.com</a>, test your browser and sign the petition!</p>
]]></content:encoded>
			<wfw:commentRss>http://www.without-brains.net/archives/72/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
