are users going to select buckets to delete? mitigations for evercookies?

[npdoty]

It may be helpful to flesh out the key scenarios as soon as you can, as I may just be misunderstanding the proposal.

One possibility of specifying different buckets that can be cleared separately is to encourage users to clear only some but not everything from an origin. Is that a goal here? There are privacy risks to partial clearing: problems with evercookies have typically led us to suggest that user agents should clear all data related to an origin simultaneously so that it can't be continually re-spawned.

Similarly, I'm not sure how the goal of helping users on shared devices will be accomplished.

[asakusuma]

Generally, storage might have data that is not specific to the user and just helps with performance, like cached assets; so we don't need to clear that information on logout, but do need to clear user-specific information on logout. Another scenario is for storage constrained devices. We've encountered a non-trivial amount of devices that have very little storage quota, and having buckets makes it easier to reason about evicting less important data first when we need to clear space. We can improve the explainer and flesh out these scenarios more, but does my explanation attempt help @npdoty ?

[npdoty]

I can understand that sites may want to clear different subsets of cached data. But I'm still not clear, and the explainer seems inconsistent on this point, whether these buckets/categories are intended to be exposed to the user or whether the user is making decisions about them, or whether it's just the site that's dividing these categories and providing hints to a UA for use cases of automatic clearing.

[evanstade]

It's a good point, specifically that the explainer says this:

Allow users to have control over which data to evict, and prevent important data from being deleted

And this (emphasis added):

The storage specification currently endows each bucket with a mode, which can be persistent or best-effort. A persistent bucket will not be evicted without user notice when the user agent experiences storage pressure. User agents may also distinguish persistent buckets in their storage management UIs. For example, Chrome presents an additional warning when a user chooses to delete persistent storage.

However, I don't think that means individual buckets will actually be user-visible. They don't have a human-readable name, nor would a user know what they contained. The phrase "distinguish persistent buckets in [...] UI" simply means that the user agent may provide a button like "clear temporary data for this origin to save space" separate from "obliterate all data for this origin to protect my privacy and save space".

[npdoty]

If the user won't have any insight or decision-making about the types of data in different buckets, then I think we should have a separate issue to consider the evercookies problem.

Separating this into buckets has the risk of making evercookies more opaque and persistent, as presumably the developer will put that into the persistent bucket and the suggestion is that users will be extra cautioned (threatened?) not to clear persistent storage.

[evanstade]

I wouldn't expect users would be cautioned against clearing persistent storage. Chrome's clear browsing data dialog makes it very easy to delete all data or choose individual kinds of data to delete. Likewise the site details page allows users to delete all data without any kind of warning beyond:

You’ll be signed out of this site, including in open tabs
Any offline data will be cleared

Which I think is fair and non-threatening :)