If you don't want LSOs, disable cookies, too. It's exactly the same thing. An LSO cannot do anything itself ; it's just a file, and the site that created it (and only the one that created it - www.example.com can't read www.example2.com's LSOs) can write in it or read it.
If the Photobox webmaster wanted to take your credit card number (I don't know anything about Photobox - I assume there is some kind of paid accounts ?), he could do so by lots of ways - cookies, LSOs, javascript, ...![;)]()
Sorry but I do not consider your assurances to be acceptable.
Officially an LSO may be non-executable data - but what prevents data from hacking my system.
30 years ago I was designing real time embedded software computers to protect against fire and intruders.
They communicated with messages that COMMENCED with a byte count,
and the receiver ensured sufficient buffer space and then validated the length and checksum of the message before making use of the data. Anything wrong and the message was ignored and the sender had to re-send.
I was horrified when I first heard that P.C.s were being hacked through "buffer overflow exploits".
I do not understand why this incompetence persists after so many decades.
The Adobe track record suggests they are no better than M.S.
No one expected Buffer Overflow attacks to plant malware for Windows to execute.
Just because we do not expect a similarly devious attack via an LSO means our defences are wide open,
and tomorrow could be the day ! !
It is possible you may be correct TODAY but :-
1. LSO'S are always evolving and overcoming our defences, tomorrow they will take over and destroy us;
2. Even today if cookies are blocked via Adobe's website, that is ignored in private browsing mode.
Here I quote w33d3r above who said
"Newer versions of flash are getting more efficient at its ability to track you, the LSO settings only adjustable on adobes website is completely ignored if you are using private modes of browsing in the newer versions of browsers".
Question and Answer on http://www.cookiecentral.com/n_cookie_faq.htm#read_other
Q. Can malicious sites read cookie information used by another site?
A. Cookies are designed to be read only by the site that provides them, not by other sites.
So of course www.example.com SHOULD NOT read www.example2.com's LSOs.
I HAVE A SUPPLEMENTARY QUESTION,
IF ADOBE is such an excellent company that always succeeds with its implementations of design intentions,
how come Secunia and others are always warning us to update Adobe Reader(Adobe Writer/Adobe Whatever).
Warning from M.S. http://msdn.microsoft.com/en-us/library/bd70eh18.aspx
The browser can send the data back only to the server that originally created the cookie. However, malicious users can access cookies and read their contents. Do not store sensitive information in a cookie, such as a user name or password. Instead, store a token that you can use to look up the sensitive information on the server. Additionally, cookies can be tampered with, so any data in cookie should be treated with the same measures you use to prevent cross site scripting attacks.
Adobe NEVER get their software right.
They always have vulnerabilities that are eventually discovered and exploited,
and then we have to un-install the old and decide whether to risk the same aggravation with an "upgrade".
That is always a concern with Adobe Reader etc, the location of which is easily found.
The innocent naive user is unlikely to know that he has an infestation of Adobe LSO's.
Even if he is warned that last year's crop have known and exploited vulnerabilities,
how will he seek and destroy these "old" security holes when Adobe allows them to be hidden in unexpected places.
The first LSO that contaminated my system was detected when I compared C:\ with R:\ and looked at the new arrivals.
C:\ is my system drive, and R:\ is a copy of C:\ when I know the system is clean and free from all malware, rubbish, and any experimental downloads I may have forgotten to delete.
I doubt that many naive users would know when they get LSO contamination.
You know nothing about Photobox, neither do I, NEITHER DOES PHOTOBOX.
Their technical support did not even know that they had started to pollute everyone with LSO's,
and they had no clue about what data they may be scattering across the Internet.
Originally I only looked at the photo's on Photobox. I was happy.
Then my wife decided she that she wanted some printed on glossy paper and posted to us,
so I broke habits of a lifetime and bought on the Internet with a credit card.
I had no fear that the Photobox Webmaster would steal my Credit Card Number.
I remain confident that there are "Operating Procedures" in place to ensure compliance with legislation concerning protection of customers credit card information.
I would hope that any file with critical credit card data is encrypted and held far more securely than my order preference (e.g. bordered/borderless prints, first class/second class postage etc.)
There should be (and hopefully is) access control restricting who can access this information, and logging all blocked attempts by people that have no business trying to view the data.
It is possible that rules could be broken and there might be a print-out that misses the shredder and falls in the waste bin, and the night-shift cleaning lady might retrieve the printout and use my credit card number.
I am not worried because a lot of things would have to go wrong, and VERY FEW PEOPLE would see that data,
and the worst that the cleaning lady could do is run up a shopping bill and the Credit Card company would "take the hit" - it would not be my loss.
Then Photobox "improved customer experience" by adding LSO's.
Immediate and repeatably consistent results :-
Unable to select a few photos from an album until the entire album was pulled into Firefox memory,
Windows ran out of memory and and shut-down firefox.
Launching Task Manager and retrying I observed that Firefox started with less than 100 MB in use,
and it steadily increased to about 1300 MB before Windows had no more to give it.
After this disaster I found Photobox had given me what turned out to be my first Adobe LSO "hickey".
That browsing session learnt very little from me apart from my user name and password and the album I selected to view, but it still learnt enough about me to plant on me a 130,000 byte sized hickey.
Imagine how much more of my disc space would have been gobbled up had it not destroyed Firefox.
I still hope that the Photobox webmaster is a good guy.
I have a very definite fear that any of the LSO data which Photobox receive will NOT be protected to the same degree as my purchase order with Credit Card Number.
Due to lack of protection the night-shift cleaning lady is more likely to find LSO data printed and discarded,
but it will still be the Credit Card company that takes the hit, and the cleaning lady is unlikely to have the ability to use this number for identity theft and the creation of new accounts in my name.
BUT A SECOND CLASS HACKER IS ANOTHER MATTER. He may not have the skill to penetrate the Credit Card file,
but he may get into the LSO data file, and either he or his contacts would be able to progress from there into theft of my identity and creation of new accounts and debts in my name.
THE DEFINITE VULNERABILITIES FROM ADOBE HICKEYS :-
Photobox Technical support were not aware that they had started to use them,
It is practically certain that Photobox do not protect LSO data as well as Credit Card data,
so a second rate hacker that cannot penetrate the official customer account details may still get at the LSO,
and thus get the credit card number from a place which Photobox did not realise was in need of protection.
I criticise Photobox because they planted the only hickey on my machine.
I have the same strong feelings about ANY web-site that plants hickeys on unsuspecting visitors.
I NEVER ALLOW MY BROWSER TO LEARN MY CREDIT CARD NUMBER,
AND IT IS UTTERLY REPUGNANT TO ME THAT ADOBE HICKEYS WILL NOW HARBOUR MY NUMBER,
AND REVEAL MY NUMBER TO ANY MALICIOUS SITE - AND EVEN INNOCENT SITES SUBJECT TO "cross site scripting attacks."
Alan