4 ms·

Google Chrome, under Settings, Advance Settings, Content Settings. I have all mine ether set to not allow or only after click to play.

benmmurphy 14y ago
click to play is not a security feature and will not prevent malicious plugins from running.
- jug6ernaut 14y ago
  Are you sure? As far as i understand it until you click on the plugin the plugin is not loaded at all.
  - benmmurphy 14y ago
    If you visit a malicious site and click anywhere on the page (not on a plugin) then you could enable a click 2 play plugin. i raised this as a chrome bug and they said click 2 play is not a security feature. there may be even worse bypasses :( the only way to have proper security is to disable the plugin. there is a button on the address bar that allows you to enable plugins on a page when they have been disabled. this gives you a similar experience to click2play but it is quite annoying especially if you are used to click2play.
    - jug6ernaut 14y ago
      Wow...well thats good to know! Doesn't really make sense, especially when you load say a YouTube webpage and it says "click to RUN adobe flash". That is really misleading! :\
      - sp332 14y ago
        It is "click to run", the problem is, it might be disguised such that ANY click on a webpage might set it off.
        fjarlq 14y ago
        Relevant Chrome click-to-play bug report: Click-to-play doesn't actually require click to play http://crbug.com/174963 http://crbug.com/174963
  - deanclatworthy 14y ago
    I can't reply further down the comment thread, but can you provide an official source on this. I enabled this feature last week, and there's no way of interacting with the plugin until I click on it.
    - benmmurphy 14y ago
      firefox has the same problem with it's click to play implementation. bug is not private so i will link to it: https://bugzilla.mozilla.org/show_bug.cgi?id=838999 https://bugzilla.mozilla.org/show_bug.cgi?id=838999

benmmurphy 14y ago

click to play is not a security feature and will not prevent malicious plugins from running.

jug6ernaut 14y ago
Are you sure? As far as i understand it until you click on the plugin the plugin is not loaded at all.
- benmmurphy 14y ago
  If you visit a malicious site and click anywhere on the page (not on a plugin) then you could enable a click 2 play plugin. i raised this as a chrome bug and they said click 2 play is not a security feature. there may be even worse bypasses :( the only way to have proper security is to disable the plugin. there is a button on the address bar that allows you to enable plugins on a page when they have been disabled. this gives you a similar experience to click2play but it is quite annoying especially if you are used to click2play.
  - jug6ernaut 14y ago
    Wow...well thats good to know! Doesn't really make sense, especially when you load say a YouTube webpage and it says "click to RUN adobe flash". That is really misleading! :\
    - sp332 14y ago
      It is "click to run", the problem is, it might be disguised such that ANY click on a webpage might set it off.
      - fjarlq 14y ago
        Relevant Chrome click-to-play bug report: Click-to-play doesn't actually require click to play http://crbug.com/174963 http://crbug.com/174963
- deanclatworthy 14y ago
  I can't reply further down the comment thread, but can you provide an official source on this. I enabled this feature last week, and there's no way of interacting with the plugin until I click on it.
  - benmmurphy 14y ago
    firefox has the same problem with it's click to play implementation. bug is not private so i will link to it: https://bugzilla.mozilla.org/show_bug.cgi?id=838999 https://bugzilla.mozilla.org/show_bug.cgi?id=838999