This link appeared in WDRL 144 on .
Backdoor Service Workers — Jeremy Keith
Jeremy Keith brings up a new point to the whole Service Worker and PWA debate: Currently, you can easily install a Service Worker via iframe without a user ever visiting the SW-site itself. Gladly, users who block third-party cookies and site data in their browser settings are safe but unfortunately this has huge potential to be abused by third-parties.