Disabling local-with-filesystem access in Flash Player 23

with recent changes in flash 23 disable, still allow opt out @ user level, or enable legacy @ system level via mms.cfg enableinsecurelocalwithfilesystem=1 setting, curious how enforcing default behavior , preventing users trusting files done.

 

i tested enableinsecurelocalwithfilesystem=0, hoping prevent users making changes , trusting content, did not appear work.

 

i thought creating master settings.sol file , using overwrite users settings.sol file, feels bad idea override file since don't want step on of user's settings/freedoms, 1 security related setting.

 

so, how can new default behavior enforced @ system level? additionally, there timeframe when legacy mode removed permanently without work around?

that's interesting suggestion.  i'd happy nominate feature future release.  make lot of sense, , aligns other administrative capabilities disabling camera/mic access across organization.

 

we know fact there lot of educational materials still in world rely on local filesytem or cd-rom playback (i know... educational , industrial training videos long-lived), , we've heard lot of folks week have been impacted.  goal flipping default, reduce attack surface.  herd immunity, etc.

 

for it's worth, @ point, user have actively download malicious, crafted swf, add local trusted sandbox, , run local filesystem in order encounter attack, @ point, pop permission dialog each request made swf remote server.  while nonzero, remaining attack surface constrained, , strikes reasonable balance between functionality , security.

 

microsoft edge has done away loading files local filesystem.  if attempt it, they'll launch ie compatibility purposes.  i'm curious see whether particular feature novelty, or if it's change mirrored across modern browser space.

More discussions in Using Flash Player

adobe