9

TL;DR

Should I be concerned about sites I have visited start a service worker in my browser which happens to be listening for events "forever"?

Can a dormant service worker track me?

Longer question

I was messing/playing around and I looked for a way to debug service worker javascript files in Firefox. Opening about:debugging showed me plenties of service worker instances installed by sites I could have visited even only once by just following a link, even if I am not logged into that site.

Example screenshot Firefox 64 shows my workers

I can see those services are stopped, for the moment, waiting for fetch events.

Question: is it possible that a malicious service worker tracks my online/offline activity without my consent even after denying usage of cookies?

Open question: shouldn't it be advisable, from a privacy standpoint, for the browser developer (e.g. Mozilla, Google) to easily allow the user to opt out for service workers from certain sites?

Threat model: when I speak about tracking, I mainly mean generating a unique ID stored within the worker's storage and using that to provide the service worker's developer with information about visited pages, etc. These information can normally be used to personalize advertising. Part of the threat model I am afraid of is to bypass privacy settings and combine information from multiple service workers/sites to identify the user and/or build a detailed profiling (mainly for marketing).

I know that Service Workers run in sandboxes, so it is my understanding that offline activity shouldn't be actually trackable.

Additional info: I block third party cookies and enable Mozilla anti-tracking mode (it is working now on Security SE for example)

Improve this question
4
  • Update: I just discovered that service workers are disabled in Private Browsing. Good to know...
    – usr-local-ΕΨΗΕΛΩΝ
    Commented Jan 25, 2019 at 14:14
  • interesting question. I noticed that Service Workers stay running (in Mozilla at least) even after a browser upgrade and restart. Although they can be disabled in Mozilla by navigating to about:config and setting dom.serviceWorkers.enabled to false
    – x457812
    Commented May 10, 2019 at 22:24
  • 1
    It seems that you can trust Service Workers as much as you trust google, according to this document: chromium.org/Home/chromium-security/security-faq/…
    – eloyesp
    Commented May 21, 2019 at 14:38
  • 1
    Not an answer, but I recommend checking out the uMatrix browser extension for selectively blocking service workers.
    – CrunchBangDev
    Commented Dec 16, 2019 at 15:57

1 Answer 1

Reset to default
4

No! Service Workers also run in origin context, just as normal JavaScript. So, for a Service Worker registered for a domain cannot really interact with Service Worker registered for another domain. Furthermore, they do not have access to the DOM, unlike JavaScript.

And, as long as you visit a site, it doesn’t need SW to track your activities within that site (compared to your Threat Model). So, it really provides no advantages over tracking.

And about open question, it does no harm simply registering a SW as it has tremendous impact over performance and such. They do restrict it to HTTPS to avoid SW registered over MITM attacks, and as already mentioned in the comment, SW are disabled in Incognito mode.

Improve this answer
6
  • 1
    Thanks for the answer. Some technical references (e.g. links to Mozilla dev) will be loved 💗
    – usr-local-ΕΨΗΕΛΩΝ
    Commented Jan 7, 2020 at 10:58
  • Should "tremendous" here be "no significant"? The sentence is contradictory and an edit was proposed for it (but it seems people rejected it without properly looking at the post).
    – Luc
    Commented Jan 20, 2021 at 17:49
  • @Luc I meant to say SW has tremendous impact over performance. I’m not sure whether you got it wrong but I assume it’s correct.
    – 1lastBr3ath
    Commented Jan 24, 2021 at 4:23
  • @1lastBr3ath Earlier in the sentence, it says "it does no harm", so then having a "tremendous [=huge] impact" is contradictory. I'm wondering if you're mixing up 'tremendous' with another word, but perhaps I'm also just reading it wrong ^^'
    – Luc
    Commented Jan 25, 2021 at 16:16
  • @Luc I meant, registering a SW does no harm thus requires no prior notification or easy opt out. And, SW does have tremendous (huge) impact in performance. So, I guess you got it wrong. Or maybe, I put it in a confusing order.
    – 1lastBr3ath
    Commented Jan 26, 2021 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .