element-hq / element-hq/element-meta
Extend widget privacy information before accepting it
- Dominant language
- No language data
- Stars
- 112
- Forks
- 26
- Avg merge
- 6h 6m
- Merged PRs (30d)
- 4
Description
### Your use case
#### What would you like to do?
With https://github.com/vector-im/element-web/issues/11262#issuecomment-554131235 we got the information about what data might get transmitted to a widget.

I would like to see this extended for privacy concerns:
1. It would be good if this warning could determine in advance not what data could, but actually will be transmitted to the widget.
2. The warning says "might transmit data to XY", and store cookies. In above screenshot I tried adding several different widgets using a self hosted dimension integration manager. It will always say dimension, even if you embed a totally different page. With dev tools we can see that e.g. `"data.url": "https://framadate.org/somehashhere"`. I would like to be able to preview what actually is embedded based on the actual content that's loaded. (I'm not sure however, some of this might be specific to how dimension works.)
#### Why would you like to do it?
1. More fine grained control/expectation about what data you're willing to expose
2. Can decide if I want to share above info to that specific site. This is important because I might trust things hosted by my homeserver or reputable organizations, but not others. Further, this doesn't depend on the widget title being set and trusted to tell me what this is.
#### How would you like to achieve it?
1. Think similar to installing an app on android: This widget requires the following: mxid, roomid, etc. This might eventually need some spec about how to define those requirements.
2. Maybe just display said url field?
### Have you considered any alternatives?
_No response_
### Additional context
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue names no repository files, tests, or entry points; start by reviewing the referenced Element issue/comment and the current widget warning implementation. The work is scoped when the project agrees what widget data and destination can be determined before consent, with requirements clear enough to implement.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100