TL;DR
Should I be concerned about sites I have visited start a service worker in my browser which happens to be listening for events "forever"?
Can a dormant service worker track me?
Longer question
I was messing/playing around and I looked for a way to debug service worker javascript files in Firefox. Opening about:debugging showed me plenties of service worker instances installed by sites I could have visited even only once by just following a link, even if I am not logged into that site.
I can see those services are stopped, for the moment, waiting for fetch
events.
Question: is it possible that a malicious service worker tracks my online/offline activity without my consent even after denying usage of cookies?
Open question: shouldn't it be advisable, from a privacy standpoint, for the browser developer (e.g. Mozilla, Google) to easily allow the user to opt out for service workers from certain sites?
Threat model: when I speak about tracking, I mainly mean generating a unique ID stored within the worker's storage and using that to provide the service worker's developer with information about visited pages, etc. These information can normally be used to personalize advertising. Part of the threat model I am afraid of is to bypass privacy settings and combine information from multiple service workers/sites to identify the user and/or build a detailed profiling (mainly for marketing).
I know that Service Workers run in sandboxes, so it is my understanding that offline activity shouldn't be actually trackable.
Additional info: I block third party cookies and enable Mozilla anti-tracking mode (it is working now on Security SE for example)