3 ms·
This seems like a security nightmare. I sincerely hope there's a way to just turn off "offline experience" in Chrome before service workers become widespread. T
by jonaf 10y ago
This seems like a security nightmare. I sincerely hope there's a way to just turn off "offline experience" in Chrome before service workers become widespread. The browser is a dangerous place to execute software. I suppose native apps can be just as insecure, but I worry about an ecosystem with many neighbors (web apps, extensions, plugins, add-ons, etc) running in the same process. It's much more likely one web app can steal my passwords from LastPass, for example, without knowing it. The chain of vectors just feels really dangerous.
- chris_st 10y agoI think the line: > It's a JavaScript Worker, so it can't access the DOM directly. Instead, a service worker can communicate with the pages it controls by responding to messages sent via the postMessage interface, and those pages can manipulate the DOM if needed. gives me some hope that it's intended to be isolated from all other tabs (including the one that started it!). There will be bugs, of course, but it looks to me like they're starting from a secure position, which gives me hope.
- tree_of_item 10y agoI don't think those things run in the same process in Chrome, and Firefox is moving towards a multiprocess model as well.
- jahewson 10y agoSandboxing means that plugins are not running in the same process at all.
- tomcam 10y agoCan someone explain why this was downvoted?
- untog 10y agoFrom my understanding, the service worker doesn't live indefinitely in the background - it reacts to events. So without additional permission prompts, it will only react when you load a page that's within the service worker scope. So I'm not sure what additional security concerns there are.