Will Flash compromise content viewing to ISP?

Question

I have read about how installing the Flash plugin in Tor introduces numerous privacy flaws, such as allowing third parties to determine who you are through determining your IP address.

Would allowing Flash allow a network admin to determine what content I am viewing e.g. videos/games?

This is on my own computer (not for example for work, i.e. nobody can install software on it but me), however I use a network I don't control. My understanding is that by default Tor will prevent the network admin seeing what I am accessing.

Answer 1

Yes.

Without even starting on the subject of it's comically long list of exploits, many of which have been discovered because they were already in use in the wild as a 0day, it will entirely break Tor Browsers protections.

While Tor Browser is configured and patched to best enforce "Proxy Obedience", Flash is a seperate application which Tor Browser cannot control. Flash, and other plugins, can and regularly do entirely disregard the proxy settings of the browser itself. This would mean any flash content you loaded would potentially, accidentally or intentionally, fetch resources or make connections outside of Tor.

Furthermore, Flash logs information about the sites it visits and the content that it loads, violating Tor Browser's anti-forensic properties. Any site could have an embedded flash element and try to cause you to store information about sites that you visit to disk meaning that your browsing history is would also be outside of the control of Tor Browser too.

This also presents a problem with persistent storage outside of Tor Browsers control because it violate Tor Browser's long-term unlinkability. A website can store and retrieve information from your computer system through Flash, Mallory can use this to store some unique value on your computer and then during later browsing sessions, retrieve the unqiue value to link the sessions together.

Answer 2

nobody can install software on it but me

Flash provides a great security-hole for people to gain access to your computer (if that is the kind of threat you face), thus nullifying the above statement. Try to avoid Flash, but if you must use it ensure it has the most recent security patches available.