Adobe Flash Player End of life - Past Dec 31 2020, how is blocking of Flash content enforced?

[farazzakirhusain]

I have a question with regard to this text I found on Adobe Flash End of Life page.

"Users will be prompted by Adobe to uninstall Flash Player on their machines later this year and Flash-based content will be blocked from running in Adobe Flash Player after the EOL Date."

Source : https://www.adobe.com/products/flashplayer/end-of-life.html

Question: I have a web application that runs on the flash player, I will not be done migrating it off Flash by December 31 2020. If I don't upgrade my broswers Chrome/Firefox after Dec 2020, will Flash-based content be blocked? If yes, how (is there a kill switch built into the browswer or the Flash Player?) and is there any way I can continue to use the Flash Player with Chrome/Firefox as long as I don't update my broswer past Dec 31st 2020?

[remco82641]

The enterprise EOL page provides more information. In short: playback will also be blocked by the Flash Player itself, but there is a whitelist option for websites. This is at your own risk and depending on browser support. HARMAN will provide commercial support.

Regarding browsers: Firefox ESR might continue to support Flash until summer 2021, as it it based on Firefox 78 and Flash will be removed in Firefox 84. This is not yet definitive, but seems to be an option according to this post. If so, you would need to use the whitelist option that Adobe provides and there will stil be security risks ofcourse. 

[Alexei5D13]

What is security risk if we use flash internally (to manage devices and firmware) wirth whitelist? Answer - ZERO security risk. Using browser with all last minute updates is much higher risk especially with all this html 5 etc.

[jeromiec83223024]

Yeah, the point of the feature is to force you to minimize your attack surface at the point that Flash Player is no longer getting patches.  Depending on what you're doing and how well you've configured your allow policies, your risk might be near-zero. 

There are some additional options for enterprises that need to use Flash Player beyond 2020, which are described here: https://www.adobe.com/products/flashplayer/enterprise-end-of-life.html

[jeromiec83223024]

The EOL guide you pointed to links off to the roadmaps for each of the major US browsers.  The story ends with the browsers removing the plug-in APIs necessary for Flash Player to run.  Before then, the browsers will continue to make Flash Player increasingly painful to run.  We're already at a fairly high level of friction in that regard, but it gets worse.

You have a couple options: 

• You could convert your web application to a standalone AIR application.  Adobe AIR is EOL, but HARMAN maintains and distributes a copy of the AIR SDK that you can license. 
  
  More info: https://airsdk.harman.com/
  
  
• Your organization and/or customers could license and distribute a maintained version of Flash Player within their organizations.  This would allow you and/or your customers to run the application unchanged, while still getting security and functional updates that keep Flash Player working.
  
  More Info:
  https://services.harman.com/partners/adobe
  
  
• You might think about providing a virtualized, ephemeral desktop environment that allows users to access your software with a legacy software configuration on modern clients, while insulating your environment from risk.  The whitelist would be helpful in risk reduction here, but since most browsers will remove the supporting APIs, you'd need to encapsulate a working configuration and secure it appropriately.  This is typically an expensive and cumbersome option, but it's not unusual for enterprises to need to maintain and secure support to legacy systems.  There's a well established playbook, and most of the big virtualization vendors have solutions.

[jeromiec83223024 · Accepted solution]

Here's an updated FAQ with options for enterprise users and application developers that need Flash beyond 2020: 

https://www.adobe.com/products/flashplayer/enterprise-end-of-life.html

[faschimi]

Hello jeromiec, thanks for the tip. I have followed the instructions of the Flash Player administration guide and I was able to set up a domain exception, both for Google Chrome and Internet Explorer, using EnableAllowList and AllowListUrlPattern in a mms.cfg file. This works even with local files, specifing a path starting with "file:///". But the swf files need to be open within one of the mentioned browsers. I was wondering if is possible to unblock an instance of Flash Player which runs inside a software, which is Articulate Storyline 2. Could you please advise?

[Javadst]

All projects by Autoplay media studio was built and Flash was used.
Also the "Swish Max" program crashes
Also programs that extracted flash files ...

[Felicia98BC]

If Flash Player will be gone by the end of December.  What do we use beyond 2020?  

[Alexei5D13]

We will continue to use Flash player next 10 years, it is obvious. It will not be available for consumer use and/or to run embedded adv pages etc but continue to work in enterprise environments; they do not block it (just you need to add your sites into white list)

[Paula98C6]

I have Adobe flash on my computer which is Windows 7.  I only use it for very specified and very limited purposes, in particular, to view PDFs such as my bank statements and tax returns which I download on my computer.  I don't use it at all to create or work on any documents.   I understand that Adobe flash will be discontinued by very early 2021.  My questiton is very simple:  If I leave Adobe flash on my Windows 7 computer, after the Adobe flash is discontinued in early 2021, will I still be able to use Adobe flash simply to view these limited and/or print these type of documents, such as my bank statements and/or tax returns.  I would not be doing any work with or on Adobe at all, simply using it to view these limited documents that require Adobe to view and sometimes to print them out from my computer.  Please let me know as soon as possible.  AND, MOST  IMPORTANTLY, IF ADOBE WILL NO LONGER BE AVAILABLE FOR SUCH LIMIED PURPOSES, WHAT CAN I INSTALL TO CONTINUE USING ADOBE FOR THESE VERY LIMITED PURPOSES, I.E, VIEWING MY TAX RETURNS AND/OR VIEWING MY BANK STATEMENTS.  I APPRECIATE A QUICK RESPONSE.  THANK YOU VERY MUCH FOR ALL YOUR HELP IN ADVANCE.

[Test Screen Name]

I wonder if you are mixing up Flash Player and Acrobat Reader/Adobe Reader. Flash Player should have nothing to do with reading tax returns or bank statements. Flash Player doesn't read any kind of downloaded file, it's for certain web sites. 

[_maria_]

"VIEWING MY TAX RETURNS AND/OR VIEWING MY BANK STATEMENTS."

Sounds like you're referring to PDF documents which aren't viewed using Flash Player, but either Adobe Acrobat or Adobe Reader - completely different software.