Block or double-key 3rd party service workers

[tildelowengrimm]

We should consider blocking 3rd party service workers. https://www.w3.org/TR/service-workers/
WebKit double-keys service workers. https://webkit.org/blog/8090/workers-at-your-service/

[Peacock365]

@tomlowenthal

For what it's worth, I have created a similar issue more than 2 years ago in the Waterfox repository:

BrowserWorks/Waterfox#545

This lengthy discussion resulted in service workers being deactivated. Service workers can intercept traffic, they are a very powerful method to track users. And, they are installing themselves silently in the background.

There is a legitimate use case for them, though, which is push notifications. If you disable service workers totally, this will result in the Push Notifications feature being broken. That being said, the vast majority of service workers are not being set for push notifications, but rather as a more powerful way of tracking users, without having any kind of benefit to the user.

So I think your goal to block them is worthy and necessary (In fact, I think this issue should have a much higher priority assigned to it, considering the things service workers can do), but the Brave team needs to go about this one in a very smart manner, to avoid breaking push notifications.

If push notifications are disabled in the settings, I think service workers should be blocked entirely. In case push notifications are desired by the user, the optimal solution would be to only set service workers when a site also asks for a push notifications permission, but I am not sure how that can be achieved, if at all. Anyway, if push is off, service workers should also be off.

[pes10k]

closing in favor of #8514