should we further mitigate threats of identifiers in local storage because some mechanisms won't clear all local storage?

[npdoty]

See https://github.com/w3ctag/security-questionnaire/issues/80 on potentially recommending further limitations on local state and identifiers.

The Mitigating Fingerprinting guidance does first note that we shouldn't add unnecessary additional local storage, and then notes the mitigation of simultaneous clearing of local state.
https://w3c.github.io/fingerprinting-guidance/#clearing-all-local-state

And the severity section notes that persistence is one factor (in particular, that things not easily cleared are of special importance), but still notes it as fingerprinting surface even when clearable. is there something additional we should say here?

[tomrittervg]

FWIW #69 strengths the guidance to not use persitent state at all and to design for feature to expect to have state cleared along with cookies.