Can't left-click or close Flash Player local storage settings popup

[Loren Amelang]

New Surface Book, 200% screen scaling; can't left-click or close Flash Player local storage settings popup (which is not scaled). Right-click works, but can't get rid of stuck dialog. I see people saying Flash dialogs only work with 100% screen scaling, but that would make the 3000x2000 screen pretty unusable. Is there a better solution?

[jeromiec83223024 · Accepted solution]

I just ordered a couple for the team the other day.  It took a while for our hardware vendor to start stocking them.

These dialogs are problematic for a number of reasons.  I'd love to see them go away entirely.  In most cases, what you're running into is our anti-clickjacking protection being overly zealous.  Flash Player is in an awkward position, where it's hard to guarantee that we're the top-most object and that our security dialog isn't obscured by something malicious that's trying to get you to click it.  It's particularly problematic if the dialog pops up over things that are moving, like video.  Fixing bugs in the clickjacking logic is a game of whack-a-mole, so we usually fix it on one config and find that it broke another resolution/display density/zoom factor combination.

The best way to deal with the situation is to just prevent the dialog from displaying in the first place.  The days when disabling Flash's Local Shared Objects bought you anything in terms of privacy are long gone -- HTML5 offers much more powerful capabilities for developing resilient behavioral tracking.  The best approach when trying to stay private is to just use the browser's incognito/private browsing mode.  This tricks Flash into thinking that it has access to write everything it wants to, but it's all happening in a temporary directory that is destroyed when you leave the private browsing session.

Since Flash Player effectively thinks that it's running with carte-blanche in Incognito mode, no dialogs get thrown (unless you've set non-default privacy preferences in the player).  Incognito mode is far superior to managing Flash's granular controls, because it also defeats the equivalent HTML5 client-side tracking approaches *and* it doesn't generally degrade the user experience.  We also do some extra stuff to help make it hard to do server-side fingerprinting, like returning a very minimal, alphabetically sorted list of fonts when in Incognito mode.  If you're curious about what can be done exclusively on the server side (and want to be depressed), check out https://panopticlick.eff.org/‌.

Anyway, to that end, you can set Flash Player to always allow sites to store local shared objects, or you can authorize it on a per-site basis, if it's a particular video site or something giving you consistent headaches.

To do that, go to Control Panel > Flash Player > Storage and choose an option.

It's also worth pointing out that there's a lot of superstition out there from the early 90's about "Flash Cookies"/Local Shared Objects/LSOs that no longer holds true.

When you clear your browser's cache, we delete our LSOs.  The feature was originally intended for things like game save data and asset caching, but some smart marketing people found it useful for backing up data from the user's cookie store, so that they had tracking that survived a user clearing their cookies.  While unfortunate and embarrassing, we've long since corrected that by adopting a behavior that we believe more appropriately matches user expectations.  Unfortunately, once you get that stink on you, it's hard to get it back off.

Hope that helps!

[Loren Amelang]

Jeromiec,

Thanks for the helpful, detailed answer! So many vendor responses these days assume the customer is an idiot...

After writing my report, I did end up finding the Flash settings in Control Panel and defaulting the choices for the problem site. Seemed to work. Good to know about incognito mode. And yes, I've seen lots of people saying HTML5 is "safer" - interesting to hear it provides more resilient tracking.

As for pop-ups over the top-most object, it seems the Surface Book is more likely to put important things (like Windows error messages!) at the very bottom of the window stack instead. You try to trigger something, nothing at all happens, and later you find a mess of dialogs behind all your real windows. Beware... 

[jeromiec83223024]

No problem.  Like LSOs in Flash, HTML5 doesn't introduce "tracking" features.  It introduces totally legitimate features that can be creatively abused for the purpose of tracking.

If you wan the gory details, this is a good rundown:

https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf