element-hq / element-hq/element-meta

Extend widget privacy information before accepting it

Open
#1,645 2 comments 1 reaction 0 assignees View on GitHub
A-Widgets O-Uncommon Privacy T-Enhancement
Dominant language
No language data
Stars
112
Forks
26
Avg merge
6h 6m
Merged PRs (30d)
4

Description

### Your use case

#### What would you like to do?
With https://github.com/vector-im/element-web/issues/11262#issuecomment-554131235 we got the information about what data might get transmitted to a widget.

![image](https://user-images.githubusercontent.com/2803622/151668583-c38b14cd-657f-43e4-9b8b-5ad524249e63.png)

I would like to see this extended for privacy concerns:
1. It would be good if this warning could determine in advance not what data could, but actually will be transmitted to the widget.
2. The warning says "might transmit data to XY", and store cookies. In above screenshot I tried adding several different widgets using a self hosted dimension integration manager. It will always say dimension, even if you embed a totally different page. With dev tools we can see that e.g. `"data.url": "https://framadate.org/somehashhere"`. I would like to be able to preview what actually is embedded based on the actual content that's loaded. (I'm not sure however, some of this might be specific to how dimension works.)

#### Why would you like to do it?
1. More fine grained control/expectation about what data you're willing to expose
2. Can decide if I want to share above info to that specific site. This is important because I might trust things hosted by my homeserver or reputable organizations, but not others. Further, this doesn't depend on the widget title being set and trusted to tell me what this is.

#### How would you like to achieve it?
1. Think similar to installing an app on android: This widget requires the following: mxid, roomid, etc. This might eventually need some spec about how to define those requirements.
2. Maybe just display said url field?

### Have you considered any alternatives?

_No response_

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue names no repository files, tests, or entry points; start by reviewing the referenced Element issue/comment and the current widget warning implementation. The work is scoped when the project agrees what widget data and destination can be determined before consent, with requirements clear enough to implement.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.