CanvasBlocker icon indicating copy to clipboard operation
CanvasBlocker copied to clipboard

Add protection for APIs in web workers

Open kkapsner opened this issue 5 years ago • 5 comments

APIs used in web workers (Worker, SharedWorker, ServiceWorker) are not protected by CanvasBlocker. They should be protected!

At the moment only the navigator API can be used in web workers but when https://bugzilla.mozilla.org/show_bug.cgi?id=1390089 lands offscreen canvas can be used to extract the canvas fingerprint.

kkapsner avatar May 11 '20 15:05 kkapsner

I do not see a good way to do that at the moment. Therefore I created https://bugzilla.mozilla.org/show_bug.cgi?id=1636977 - maybe Firefox will implement something useful.

kkapsner avatar May 11 '20 15:05 kkapsner

I triaged the Firefox bug report for you, hopefully it gets picked up. 👍🏻

geeknik avatar May 11 '20 16:05 geeknik

Thanks.

kkapsner avatar May 11 '20 18:05 kkapsner

maybe sth for reference https://github.com/jingyu9575/service-worker-control

Riajyuu avatar Jul 01 '20 02:07 Riajyuu

Thanks for the link. The protection approach is a little bit different so I think I have to do it different. But I may have some ideas of how to do something myself...

kkapsner avatar Jul 07 '20 11:07 kkapsner