A Preview of the Flash Kill Switch: January 12, 2021 and Beyond

tech234a — Fri, 01 Jan 2021 01:00:00 +0000

Adobe Flash has a kill switch that has been included in versions released since mid-2020. On January 12, 2021, Adobe will activate this kill switch, rendering internet-based Flash content inaccessible.

Do you still use Flash Player? Data Horde is conducting a survey to see how frequently people continue to use Flash Player even at the very end of its lifespan. It would mean a lot to us if you could spare 5-10 minutes to complete a very short survey.

Why is there a kill switch built into my Flash Player?

Adobe has decided to retire Flash Player, which means no more updates. Adobe has stated their reasoning behind the inclusion of this kill switch is to “help secure” users, seeing as Flash Player might still have undiscovered security vulnerabilities.

In doing so, Adobe hopes to no longer be liable for any damage caused by vulnerabilities present in Flash Player, by making Flash Player outright unusable. Overkill? Kind of. For more details see Update: 12 Day Grace Period on the Flash Player Killswitch

Update: 12 Day Grace Period on the Flash Player Killswitch

What does the Flash Player kill switch do?

Here is an in-depth preview of the effects of this kill switch. When accessing Flash content in a web browser, if your system time is set to January 12, 2021, 12:00AM (midnight) or later, Flash content will be replaced with a Flash information button. Note that if you have already loaded Flash content before this time, you will be able to continue viewing it until you reload the webpage in your browser.

While you roll over the widget, it shows a blue outline.

While you left click the widget, it turns blue.

Right clicking still works as normal for a Flash applet.

Clicking the icon opens a new tab to the URL https://www.adobe.com/go/fp, which redirects to https://www.adobe.com/products/flashplayer/end-of-life.html (Adobe’s End-Of-Life info page) as of this writing.

Browser Support

Browsers will also be removing support for the Flash plugin. The following updates are scheduled to remove Flash support in common browsers:

Chrome 88 (Windows 7, 8.1, 10): 1/19/21
Firefox 85 (Windows 7, 8.1, 10): 1/26/21
Edge 88 (Windows 7, 8.1, 10): week of 1/21/21
Safari 14 (macOS 10.14, 10.15, 10.16/11.0): 9/16/20
Windows Preinstalled/Internet Explorer/Edge Legacy (Windows 8.1, 10): optional update in early 2021 and recommended a few months later

Most of the browser updates simply drop support for loading the Flash plugin.

The Flash component is fully removed in Chrome 88. Flash Player permissions are removed from site content settings, and clicking on a Flash download link no longer prompts the user to allow Flash (the link functions as a normal).

Chrome Specifics

If a website specifies fallback HTML code, it is displayed.

If a website does not specify fallback HTML code, Chrome 88 replaces Flash components with a message stating “Adobe Flash Player is no longer supported”. Nothing happens when attempting to right click the widget.

Other Chromium-based browsers, including the current versions of Edge, Opera, and Vivaldi are expected to behave similarly.

Chrome also plans to block Flash from loading in previous versions of Chrome by marking the component as outdated (you can view the components manager in Chromium-based browsers at chrome://components).

After loading a page and approving Flash permissions, you will get a message bar similar to this, stating that “Adobe Flash Player was blocked because it is out of date”.

Right-clicking on the Flash widget provides a few options:

Clicking “Update plugin” goes directly to Adobe’s Flash Player End-Of-Life page. Clicking “Learn more” opens the URL https://support.google.com/chrome/?p=ib_outdated_plugin, which redirects to Google’s Flash Player End-Of-Life support article.

After clicking “Update plugin”, returning to the tab with the Flash player widget reveals a new message on the Flash player widget: “When finishes updating, reload the page to activate it” [sic].

As of this writing, the “Run this time” option functions as intended: it allows Flash player to run once, but accessing Flash content after reloading or navigating to another page requires clicking the button again.

Attempting to update the Adobe Flash Player component from Chrome’s component manager at chrome://components reveals no available updates.

This particular method of blocking Flash appears not to be currently active in other Chromium-based browsers at this time.

Note: Loading a custom PPAPI Flash Player DLL through command-line flags to Chrome does not seem to fix the problem, but further testing (including with older and modified versions of Flash) is needed. A sample command would be "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --disable-bundled-ppapi-flash --ppapi-flash-path="". Note that you should fully quit any existing instances of Chrome before using this command by entering chrome://quit in the address bar, and that you can verify the command flags and Flash DLL used the current instance of Chrome by visiting chrome://version. Using a custom Flash DLL Flash path seems to cause Chrome to always report the Flash version as 11.2.999.999. Special thanks to @krum110487 and @nosamu from the Flashpoint Discord server for providing this information.

Firefox Specifics

Flash support is also entirely removed in Firefox 85. The plugins manager at about:plugins no longer lists Shockwave Flash, even if it is installed on the system.

In Firefox 85, if a website does not specify fallback HTML code, nothing replaces the Flash widget.

If fallback HTML code is specified, it will be displayed.

While Firefox 85’s lack of warning or user notification of missing Flash content when there is no fallback HTML code may seem weird, it is likely that this behavior follows the HTML standard more closely.

Other Browsers

Internet Explorer and Edge Legacy aren’t expected to exhibit any special behavior for the Flash shutdown, however, on January 12, 2021, Microsoft is expected to release an update to remove the preinstalled Flash player used by those browsers from Windows 8.1 and 10.

Workarounds

The Flash Player kill switch will break your Flash Player, but there are still workarounds to continue to view/interact with Flash Media after January 12!

There are many projects such as Ruffle and Flashpoint to ensure compatibility and preservation of Flash media, so hang onto your .swf’s!

For a thorough list of workarounds and other resources see this page.

How to run Flash in 2021: Flash Player EOL Workarounds!

Suggestions? Contact [email protected]

Update January 22, 2021: Linked new EOL killswitch workarounds.

Update January 11, 2021: Added screenshots and additional information for Chrome’s interface for marking the Flash Player component as outdated. Added a note that loading a custom Flash Player DLL in Chrome does not seem to prevent the block.

Special thanks to @themadprogramer for expanding the context for the article, adding a video, providing workarounds, and linking related Data Horde content.

2020 – Data Horde