diff --git a/index.html b/index.html index d1ea9d6..bb3ed81 100644 --- a/index.html +++ b/index.html @@ -1171,7 +1171,36 @@
+Once a verifier knows of a status list and entry index that is +associated with a specific holder, it becomes possible for that +verifier to see updates to that status entry as long as the +status list continues to be updated. This is useful to a verifier that +needs to understand when a particular verifiable credential has changed +status without asking the issuer directly for status information on +the specific verifiable credential or when interacting with the holder to get +the latest status information is not possible. The feature can also cause a +privacy violation for the holder and/or subject(s) if the +verifier is able to perform near-real-time checks on the status of the +verifiable credential. +
+ ++Issuers can provide a level of reprieve from this privacy concern +holders by revoking and reissuing effectively the same +verifiable credential on a timeline that is relatively short in nature. +For example, an issuer could automatically reissue a +verifiable credential every three months and assign a new status entry +index when the reissuance occurs to break any sort of long-term monitoring +of a verifiable credential as it changes status. +
+ +This specification provides a means by which multiple status messages can be provided for a particular entry in a status list. While this mechanism can @@ -1199,6 +1228,36 @@
+When a status list uses the status messages feature, it becomes possible for +the issuer to increase the types of messages that are associated with +the verifiable credentials it issues over time. +
+ ++This feature creates a potential privacy violation where the +subject or holder of the verifiable credential might be +associated with additional status information that was not present when the +original verifiable credential was issued. For example, initial status +messages might convey "delayed" and "canceled", but additional status messages +might be added by the issuer to convey "delayed due to non-payment" and +"canceled due to illegal activity". This change would not be apparent to the +subject or holder unless there was monitoring software operating +on their behalf that would warn them that the issuer intends to expose +additional information about their activity. +
+ ++Holder software can provide features to holders that warn them about the +level of holder and/or subject information exposure when using +verifiable credentials that are associated with status messages, and warn +them when the level of information exposure changes. +
+