Master of web puppets: abusing web browsers for persistent and stealthy
1–10 of 10 posts
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#2It doesn't make sense for service workers to need to keep running after I have closed a tab. I then need them terminated for sure. No exceptions.
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#3Service workers are a terrible mis-feature. Ask anybody and they won't know that things can keep running in the background when tabs are closed. Even most developers don't know about it.
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#4Service workers are a terrible mis-feature. Ask anybody and they won't know that things can keep running in the background when tabs are closed. Even most developers don't know about it.
I just checked my about:config (icecat) and see-
dom.serviceWorkers.enabled = false
Is this the only thing that needs to be checked to turn them off? (And, curious, is this enabled in newer FF ESR versions?)
I don't feel like I'm missing out on anything considering it was already disabled in this version (without me knowing about it).
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#5It doesn't make sense for service workers to need to keep running after I have closed a tab. I then need them terminated for sure. No exceptions.
Service workers are used to listen for events for browser notifications.
That's the only legitimate use I know for a service worker to be alive after the tab is closed.
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#6PeriodicSync is not part of any specification according to MDN.
The article says: "This page installs a service worker (the Servant) when loaded in the browser, and uses background sync registrations to keep the Servant always alive."
Without periodicSync is this a realistic scenario?
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#7Service workers are a terrible mis-feature. Ask anybody and they won't know that things can keep running in the background when tabs are closed. Even most developers don't know about it.
Except when anybody wants something to keep running in the background, then those "anybody" are dismayed it doesn't do that.
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#8Service workers are a terrible mis-feature. Ask anybody and they won't know that things can keep running in the background when tabs are closed. Even most developers don't know about it.
That's great until you click "Send email" and close the tab. Then you expect things to continue to work.
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#9Service workers are a terrible mis-feature. Ask anybody and they won't know that things can keep running in the background when tabs are closed. Even most developers don't know about it.
That's great until you click "Send email" and close the tab. Then you expect things to continue to work.
The page could use an onunload handler to ask the user if they really want to close the tab before the email has been sent.
Re: Master of web puppets: abusing web browsers for persistent and stealthy
#10Earlier quoted context omitted.
That's great until you click "Send email" and close the tab. Then you expect things to continue to work.
The page could use an onunload handler to ask the user if they really want to close the tab before the email has been sent.
That's what happens now, but it's really not great UX.
Typically by the time the user reads the modal dialogue telling them not to close the window, the email will be sent. The page then needs to make clear "hey that thing we just said? You can ignore it now".
I appreciate the suggestion, but it's just a very confusing and disruptive approach to solving the problem.