Paranoid Service Worker
summary
Describes a practical method to protect private keys in the browser by intercepting requests with a Service Worker, performing signing exclusively inside the Service Worker, enforcing strict cache and integrity checks for code paths, and using data: redirect sandboxing to stop extensions from creating pages that can read secrets. The prototype uses notification actions for explicit user confirmation and forces cached, integrity-verified code; an external audit shows resistance to extension-based key theft though no absolute guarantee is claimed.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 6:42Browser extension security
- 11:17Network protocol flaws
- 15:30HTTPS/TLS flaws
- 21:29Service Worker basics
- 26:49Securing Service Worker
- 30:44Bypassing plugin flaws
- 35:25Key theft protection
- 42:48Q&A
related talks
17mService Worker and the Appification of the Web
01h 00mOffline
30mWeb Service Workers - Breaking The Web Because It Would Be A Sh...
23mGo Offline with Service Workers
22mPWA as a new Cyber Attack Vector
46mWhat Can Traditional Web App Security Learn From Browser Wallet Extensions?
02mProposing the ‘Signature’ Auth Scheme: More Usable AND Secure Than Status Quo
35mTame your service worker [...]