6

TL;DR

Should I be concerned about sites I have visited start a service worker in my browser which happens to be listening for events "forever"?

Can a dormant service worker track me?

Longer question

I was messing/playing around and I looked for a way to debug service worker javascript files in Firefox. Opening about:debugging showed me plenties of service worker instances installed by sites I could have visited even only once by just following a link, even if I am not logged into that site.

Example screenshot Firefox 64 shows my workers

I can see those services are stopped, for the moment, waiting for fetch events.

Question: is it possible that a malicious service worker tracks my online/offline activity without my consent even after denying usage of cookies?

Open question: shouldn't it be advisable, from a privacy standpoint, for the browser developer (e.g. Mozilla, Google) to easily allow the user to opt out for service workers from certain sites?

Threat model: when I speak about tracking, I mainly mean generating a unique ID stored within the worker's storage and using that to provide the service worker's developer with information about visited pages, etc. These information can normally be used to personalize advertising. Part of the threat model I am afraid of is to bypass privacy settings and combine information from multiple service workers/sites to identify the user and/or build a detailed profiling (mainly for marketing).

I know that Service Workers run in sandboxes, so it is my understanding that offline activity shouldn't be actually trackable.

Additional info: I block third party cookies and enable Mozilla anti-tracking mode (it is working now on Security SE for example)

  • Update: I just discovered that service workers are disabled in Private Browsing. Good to know... – usr-local-ΕΨΗΕΛΩΝ Jan 25 '19 at 14:14
  • interesting question. I noticed that Service Workers stay running (in Mozilla at least) even after a browser upgrade and restart. Although they can be disabled in Mozilla by navigating to about:config and setting dom.serviceWorkers.enabled to false – x457812 May 10 '19 at 22:24
  • 1
    It seems that you can trust Service Workers as much as you trust google, according to this document: chromium.org/Home/chromium-security/security-faq/… – eloyesp May 21 '19 at 14:38
  • Not an answer, but I recommend checking out the uMatrix browser extension for selectively blocking service workers. – CrunchBangDev Dec 16 '19 at 15:57
2

No! Service Workers also run in origin context, just as normal JavaScript. So, for a Service Worker registered for a domain cannot really interact with Service Worker registered for another domain. Furthermore, they do not have access to the DOM, unlike JavaScript.

And, as long as you visit a site, it doesn’t need SW to track your activities within that site (compared to your Threat Model). So, it really provides no advantages over tracking.

And about open question, it does no harm simply registering a SW as it has tremendous impact over performance and such. They do restrict it to HTTPS to avoid SW registered over MITM attacks, and as already mentioned in the comment, SW are disabled in Incognito mode.

  • Thanks for the answer. Some technical references (e.g. links to Mozilla dev) will be loved 💗 – usr-local-ΕΨΗΕΛΩΝ Jan 7 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.