1

The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend a secure way to update flash?

2
  • 2
    Isn't get.adobe.com accessible through https? If you get redirected to http://get.adobe.com/fr/flashplayer (or any other url) because your browser settings show you speak a language other than english, you can just simply add the s to http after the redirection. It's weird by adobe, but it works.
    – user10008
    Commented Aug 12, 2014 at 20:17
  • This almost works ... sometimes I get redirected to the insecure page, but sometimes I can connect to https (though firefox flags the page as not fully secure). The bigger question is why Adobe would send people to the insecure page by default. Commented Aug 13, 2014 at 3:05

2 Answers 2

2

When you go to http://get.adobe.com/flashplayer/, it will forward you to http://get.adobe.com/**/flashplayer/ where ** is the two-letter code of the preferred language according to your browsers headers. You can then change this from http to https to get the encrypted version, which will have a https link to the latest flash installer.

By the way: When you use the highly recommendable HTTPS Everywhere browser addon, you get to the country-specific https-site automatically.

-2

Why does the Adobe download site need to use SSL? Do you need the flash update to be encrypted? SSL doesn't make a site secure. You can download all kinds of malware and exploited content from an SSL connection, it's just that other people won't be able to see it.

If there is no sensitive information to be obtained by downloading a flash player update from Adobe then i see no reason to worry. If you are looking for the little icon that means the site is using SSL, it really isn't foolproof. Never click on a link that takes you to a site for a Flash Player update, always type www.adobe.com in manually. There are too many fake update notices on the Internet to trust a link to take you to the correct site.

1
  • 1
    I think what the author is actually afraid of are man-in-the-middle attacks which change the file in transit. TLS would prevent that.
    – Philipp
    Commented Aug 27, 2014 at 23:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .