Flash Blocked In Firefox Over Security Risk

Mozilla has blocked Adobe Flash from running by default in the Firefox browser, citing security concerns. Meanwhile, Facebook's security chief has called for Adobe Flash to be killed off permanently.

Adobe Flash is widely used for both videos and animations, including ones which play automatically on a website. The technology has fallen from favor over the years, however, thanks to problems with both performance and security. It's a popular target for malware creators as it is so widely used by users, regardless of their operating system or browser.

A big part of the decline came when Apple decided its iPhone and iPad would not ship with Flash installed, making it difficult, if not nearly impossible to manually add it. That said, many websites are switching to the HTML 5 system that is built directly into modern browsers without the need for plugins, and without the need for Flash.

Hacking Leaks Raise Risks For Adobe Flash

Now Mozilla has taken action after two separate incidents where it became clear that Flash had vulnerabilities that were being exploited by hackers. In both cases, the details became clear thanks to leaked documents belonging to Hacking Team, a business which helps governments use spyware techniques for surveillance.

Mozilla was unsatisfied with the speed at which Adobe developed and released a fix and decided to simply block Flash by default. Users can still access Flash content but must actively click a link and then confirm they understand the risks of doing so. It's a mechanism similar to the way Google's Chrome blocks links to sites suspected of housing malware. (Source: techcrunch.com)

Facebook Wants To Set Execution Date

Frustration with Adobe Flash isn't confined to Mozilla. Alex Stamos, who recently took over as chief information security officer at Facebook, posted on Twitter this week that "it is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day. Even if 18 months from now, one set date is the only way to disentangle the dependencies and upgrade the whole ecosystem at once." (Source: fortune.com)

In this context, a killbit would be an instruction in the code that runs the browser to completely block Flash from running after a specified date.

What's Your Opinion?

Do you have Flash enabled in your Internet browser? Is it a security concern for you? Would the inconvenience of not accessing Flash content outweigh any risks?