Joel H. Simplex ([info]njyoder) wrote in [info]lj_dev,
@ 2008-04-01 05:06:00
Previous Entry  Add to memories!  Tell a Friend!  Next Entry
Embedding Adobe Flash applets.
Isn't there a potential security/privacy/nuisance issue with allowing people to embed arbitrary Flash applets from any website?

I'm not that familiar with Flash's capabilities in terms of reading from or manipulating the web browser, but I know a few other things that can be done.

At the very least, people can use Flash cookies to track users even if their IP address changes. I'm sure that people wouldn't appreciate this.

And of course, it can be made to be a huge nuisance by vastly slowing down a computer and potentially crashing the web browser. Of course, it can also display arbitrary video and play arbitrary audio.

The solution to this, which I previously mistakenly thought was already implemented, is to only allow flash from certain trusted sites, such as YouTube. Since 99% of embedded Flash on LiveJournal is from a relatively small list of websites, this shouldn't be hard to maintain, especially with a submission form to add new websites.

(Post a new comment)


[info]loic
2008-04-01 05:21 pm UTC (link)
yes. Flash applets can steal peoples' cookies and other fun stuff.

You can do magic like LJ does to automagically run them from a different domain though.

(Reply to this)(Thread)

[info]henrylyne
2008-04-01 05:41 pm UTC (link)
Just like [info]loic said, if you load them from a different domain and inside an iframe, you essentially isolate that content from having access to your user's cookies or anything else.

(Reply to this)(Parent)(Thread)

[info]njyoder
2008-04-02 03:25 am UTC (link)
Oooh, good point. I didn't realize what that iframe was for until now. It appears to be lj-toys.com or something. That makes more sense.

(Reply to this)(Parent)

[info]netik
2008-04-01 06:38 pm UTC (link)
For starters, flash's security model doesn't allow the flash application to send data to any other server except the server from which the flash application originated from, unless there's a shared security key on the remote machine.

LJ limits the sites that you can use the embed tag with to youtube and a couple others.

(Reply to this)(Thread)

[info]njyoder
2008-04-02 03:26 am UTC (link)
According to others, that was the OLD policy and now they load it from an iframe from an independent .com domain, to prevent this kind of problem.

(Reply to this)(Parent)

[info]azurelunatic
2008-04-01 09:14 pm UTC (link)
LJ used to only run them from trusted sites, but as the list of sites that people wanted to embed stuff from got longer and longer, LJ started loading them from a different domain inside an iframe. So you were right about thinking that it was implemented. :) Just there's a new solution now.

(Reply to this)

Create an Account
Forgot your login?
Login w/ OpenID
English • Español • Deutsch • Русский…