Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page.

Until I encountered this service, I had no idea that flash was able to do screen reading, as opposed to simpler tasks like using the web cam. But if it can do that, could it not also be recording keystrokes, storing all data from a session for someone's perusal, or the like?

Once you trust a website to provide a viewport into your company's computers' screens, who is to say that they will not be sharing details of the session? And given the nature of flash, who's to say that the session is really closed just because you close the browser window?

share|improve this question

1 Answer 1

While the "watching a screen" aspect of that site is pure flash, the screen sharing component is not. When you attempt to share your screen, it downloads an executable to install; an .exe on Windows, and a .pkg on Mac.

So, yes - it's a foreign binary with the capability to steal all of the data you mentioned and more; but the sharing isn't using flash, so your fears on its access to data outside of the browser are (thankfully) not the case.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.