search

Ocelot-Social-Community / Ocelot-Social

Free and open-source social network for active citizenship.
https://ocelot.social
Other
92 stars 36 forks source link

🚀 [Feature] Privacy by design for embedded content #3658

Open Tirokk opened 3 years ago

Tirokk commented 3 years ago

sushidave Authored by sushidave

:rocket: Feature

This is step 2 of 2 to enhance data privacy for embedded content of third party providers. The 1st step is #3657

Privacy by design: Third party content providers should not get any user data due to embedded content unless users opt-in - by agreeing to load third party content or unless they click on a link.

User Problems

Currently, user data is shared with third party providers even if the user has not agreed to display embedded content. This also applies to other providers than those listed in the account settings.

For videos:

The embed code shows that the preview image has been loaded from a third party provider.

youtube-embed-no-thanks-code

For videos, this contradicts to what is shown to the user: hc-embedded-content-privacy-notice

Other content:

Content from providers not listed in the account settings is embedded by default too, so user data is disclosed to those providers as well.

Implementation

Implement privacy by design and a consistent opt-in policy.

For embedded content if the user disagreed to display embedded content:

Design & Layout

If the option for displaying embedded content is set to "No thanks" show the warning box instead of a content preview:

hc-embedded-content-privacy-notice-privacy-by-design-new

If the user clicks on 'Continue' show the embedded content:

hc-embedded-content-display

Validation

Comply with privacy by design.

Additional context

This is step 2 of 2 to enhance the data privacy for embedded content. The 1st step is #3657.

To Dos

Tirokk commented 3 years ago

Tirokk Authored by Tirokk

Hey @sushidave , thanks for creating this issue as well! 🤗

sushidave commented 2 years ago

FYI - Individual workaround until this feature is implemented:

  1. Install browser plug-in UBlock Origin.
  2. Right-click on an embedded preview image.
  3. In the pop-up window click the URL shown under "network filter", e.g. ||i.ytimg.com/vi/vV0R5S4M33I/maxresdefault.jpg
  4. In the editor shorten the URL to ||i.ytimg.com/. This will suppress preview images from YouTube to be embedded.
  5. Click "Create".
  6. Repeat it with images of other third party providers.

This is not a general workaround covering all users but it requires an action by the individual user.

sushidave commented 2 years ago

@roschaefer Is it correct that in the example above user data is shared with the third party provider due to the URL of the image tag?

As discussed with @Tirokk

sushidave commented 2 years ago

@Tirokk Can I work on this issue?

Tirokk commented 2 years ago

@ogerly here the data privacy warning is not shown anymore, says @sushidave . See screen shot above. Or have we removed it?

Could you have a look on this?

Because if we show the preview the content provider gets information from the user, says @sushidave , what shouldn't happen. Or?.

Tirokk commented 2 years ago

@Tirokk Can I work on this issue?

Yes, you can !!! 👍🏼 @sushidave

sushidave commented 2 years ago

@Tirokk and I discussed two alternative solutions:

Decision:

  1. Implement this issue #3658.
  2. Evaluate one or both of the other solutions and maybe make it configurable for the network admin.