this is particularly annoying if I mistakenly type the wrong domain into an exception (or change my mind later) and the only way to remove it is to nuke the whole site's contents

The initial mocks for Site Settings on *Desktop* didn't have a Cookie Data viewer -- it was only added later due to push-back.

Android, in comparison, never had a Cookie Data viewer -- Site Settings was mostly all new UI (hardly any previous UI to compare with) and a Cookie Data viewer was not part of what was spec'ed.

So, as for the question of intent: My understanding is that we'd like to have a Cookie Data viewer for Android, but it was not within scope when I was working on it and it's not on anyone's plate at the moment.

Discussion on removing individual permissions, Comments 45-50
https://bugs.chromium.org/p/chromium/issues/detail?id=378412#c45

Need to check with Security on preferences for Cookies in android but I believe we don't want to go as deep as we do on Desktop. Can confirm latest thinking there.

Hmmmm -- I don't find this description to be vague. Let me know if anyone else thinks it's vague.

right now the prompt says "all local data, including cookies, and reset all permissions for this website" when it'd better if it said "3 cookies from m.mentalfloss.com" (i.e. specific data type summaries, specific site)

Confirmed with ainslie@ we want to stick with clearing all of a site vs individual settings for now. (We're trying to avoid the case where a user sets themselves up to be prompted with another dialog.) We also want to bring mack more utility to page info itself so clearing all of a site doesn't feel like the primary action.

Thanks for the added context on what would make the dialog more helpful. We only just recently implemented counts for clear browsing data, to explain how much state you'd be losing (people were sometimes clearing more than they intended.) To follow that model, the count of anything would be on the site page itself, before you hit clear. The only thing missing that's not spelled out is number of cookies. I'm not sure how useful it would be to count them. For one, we don't intend to have individual cookie management in Android settings, and for another, we don't have this in the plans for site settings on desktop (I don't think) where cookie management per site is handled via the page info bubble.

Here's the related bug where we added "including cookies" to the string:
https://bugs.chromium.org/p/chromium/issues/detail?id=445962
It was more about being clear that the entire site would be forgotten, in line with the user's intent.

One option would be to list the number of cookies under the storage amount and allow a separate clear for that, but we don't have that planned for desktop... Ultimately I defer to the Security team on the value of listing the number of cookies for the site in site settings page. My vote is that it's always an option and I'm open to making site settings useful, but I can how focus on the OIB/page info to think more about cookies there to be most useful (as OIB is only one tap away.)

even just omitting "cookies" when there are no cookies actually being cleared would be an improvement

as in: right now the context in which you invoke the delete prompt is great: it shows what you'd clear.  but when you reach the delete prompt, it gets ... less smart.  "be careful, you'll clear X, Y, and Z!" even if the user is only really clearing Z.

this isn't a big deal, it's just unfortunate because there's a super specific, awesome summary shown right before this dialog.  i was hoping to just reuse that code.

if we want to keep the "blow the whole site away or nothing" behavior, i'll reduce this to a P3 if it's now just about the wording of the prompt.

(and fwiw: I think removing all site data rather than dealing with individual cookies or whatever is sane and probably more useful anyways)

Ah I see. So change the dialog to not include permissions if there are no permissions listed, not include cookies if there are no cookies detected.

I'm almost tempted we do away with confirmation altogether! We don't have a confirmation for clear browsing data so perhaps we assume we don't need one here. Maybe just an undo snackbar.

[site.com was cleared and reset UNDO]

Alternatively we'd have a variety of strings based on what's available:

SITE HAS EVERYTHING
Are you sure you want to clear all local data, including cookies, and reset all permissions for this website?

SITE HAS NO COOKIES
Are you sure you want to clear all local data and reset all permissions for this website?

SITE HAS NO PERMISSIONS
Are you sure you want to clear all local data, including cookies, for this website?

Etc.

How about an "undo" alternative rather than a vague confirmation, considering the page itself is pretty specific?

The messaging is particularly confusing right now if you have two entries for the same site in Site Settings > All Sites, one of which (listed as a full origin e.g. https://tests.peter.sh) has notification permissions attached, and the other one (listed as a domain e.g. tests.peter.sh) has storage settings attached. Clearing storage for the domain (via All Sites > [domain] or Site Settings > Storage > [select domain] > Clear And Reset) does not reset notification permission for the origin, so it shouldn't imply that it would.

Emily, are there any plans to unify the origin and domain listings under Site Settings > All Sites ?

We indeed hope to have an All Sites page in the near future, and in the longer future I think it would be great to group origin listings by domains. 

+raymes for more thoughts on the message

Removing myself and adding +maxwalker as the primary contact for security. You can also bring in srahim@ for strings when ready.

I don't feel too strongly about the message. It could probably be improved but I don't think users will be too confused.