Should I be concerned about sites I have visited start a service worker in my browser which happens to be listening for events "forever"?

Can a dormant service worker track me?

Longer question

I was messing/playing around and I looked for a way to debug service worker javascript files in Firefox. Opening about:debugging showed me plenties of service worker instances installed by sites I could have visited even only once by just following a link, even if I am not logged into that site.

Example screenshot Firefox 64 shows my workers

I can see those services are stopped, for the moment, waiting for fetch events.

Question: is it possible that a malicious service worker tracks my online/offline activity without my consent even after denying usage of cookies?

Open question: shouldn't it be advisable, from a privacy standpoint, for the browser developer (e.g. Mozilla, Google) to easily allow the user to opt out for service workers from certain sites?

Threat model: when I speak about tracking, I mainly mean generating a unique ID stored within the worker's storage and using that to provide the service worker's developer with information about visited pages, etc. These information can normally be used to personalize advertising. Part of the threat model I am afraid of is to bypass privacy settings and combine information from multiple service workers/sites to identify the user and/or build a detailed profiling (mainly for marketing).

I know that Service Workers run in sandboxes, so it is my understanding that offline activity shouldn't be actually trackable.

Additional info: I block third party cookies and enable Mozilla anti-tracking mode (it is working now on Security SE for example)

  • Update: I just discovered that service workers are disabled in Private Browsing. Good to know... – usr-local-ΕΨΗΕΛΩΝ Jan 25 at 14:14
  • interesting question. I noticed that Service Workers stay running (in Mozilla at least) even after a browser upgrade and restart. Although they can be disabled in Mozilla by navigating to about:config and setting dom.serviceWorkers.enabled to false – x457812 May 10 at 22:24
  • 1
    It seems that you can trust Service Workers as much as you trust google, according to this document: chromium.org/Home/chromium-security/security-faq/… – eloyesp May 21 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.