>I agree that web storage is conceptually a nicer model with a smaller attack surface. I see the exact opposite. The attack surface provided by enabling JavaSc

>I agree that web storage is conceptually a nicer model with a smaller attack surface. I see the exact opposite. The attack surface provided by enabling JavaScript is far greater. Cookies work with JavaScript disabled while Web Storage does not. If one is really really paranoid, hiding behind 7 proxies, using Tor, then one has JavaScript off entirely.