Manual service worker pinning for security-conscious PWA apps

[tuntuntunsahur]

Per the well-known article "Javascript Cryptography Considered Harmful", it is quite hard to call any encryption tool on the web safe when the server can just update it. while keeping static pages secure is a reasonable ask, a TOFU mode would be quite helpful to the web. I am aware Mozilla has a negative position on IWAs, but this is not an IWA. This concerns Github Issue 822 in w3c/service worker. This allows the trust model to be extended from client and server to client + TOFU, putting it more in line with importing PGP keys.

There were two serious downsides discussed. For one, malware could lock itself by force, making it immortal. That was a serious objection to the service worker having control over updates. I do agree with this; the service worker should not be able to forcefully stay installed.

Next, AppCache, retired years ago, allowed something like this. A big issue it had was that developer errors allowed devs to perma-brick their domains by releasing a buggy worker that caches the site forever. That is of course unacceptable and can render a million-dollar domain worthless.

So, what do we get? The browser should always retain control over the worker at the end. However, the browser need not automatically do this for you. Instead, I propose it expose a prompt by force if "pin-updates: manual" is enabled. This allows security sensitive apps to disable forced updates. This can protect PGP-like software and whatnot from compromising users with secret javascript. Additionally, on the URL bar, it should say "locked app" just like Persist mode does; this button can also be used to uninstall the app or "free" it if necessary. As a result, the server can always prompt the user to upgrade the app, preventing lock-ins for devs.

[Jon]

Thanks for submitting an idea to the Mozilla Connect community! Your idea is now open to votes (aka kudos) and comments.