<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Aug 31, 2009, at 11:35 AM, Peter Kasting wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Baskerville; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div>Again, the spec now says in 4.3: "User agents should expire data from the local storage areas only for security reasons or when requested to do so by the user." The only stronger statement you could get would be by changing this to a "must". It's not clear to me that that is going to result in any practical difference on the part of implementations or author perception.</div></span></blockquote><br></div><div>If you combine that statement with section 6.1's "User agents should present the persistent storage feature to the user in a way that does not distinguish them from HTTP session cookies", then the result is that, when the user requests to delete cookies from a site, the UA will also delete that site's local storage. That is <i>exactly</i> the behavior I am concerned about.</div><div><br></div><div><blockquote type="cite"><div class="gmail_quote"><div>This sounds like you are either completely ignoring, or disagreeing with, my claim that UAs aren't going to be flippant about this data.</div></div></blockquote><div><br></div></div><div>If UA's shouldn't treat the data lightly, then I would prefer to see a statement to that effect in the spec, such as the one that was just deleted.</div><div><br></div><div>Local storage is a significant change from the browser's current data model, and I think that (no offense) browser developers are not used to taking care of user-critical data for longer than the duration of a DOM tree or POST request. It's a change in perspective. Coming as I do from a client-software world, it's actually an eye-opener to me that this is even controversial.</div><div><br></div><div>—Jens</div></body></html>