Correlation via frequency of claim issuance

[msporny]

The rate at which an issuer issues claims may be a privacy violation because the holder of those claims may use them in a particular pattern that exposes what the claims are being used for. For example, short-lived over-21 claims being used to correlate that someone went to a particular bar.

[David-Chadwick]

I dont think you can infer that. The issuer might infer that the holder is rapidly consuming something that requires you to be over 21, but cannot have any idea of whether it is a bar, brother, drug den or whatever else. And certainly cannot infer it was a particular bar.

[msporny]

I dont think you can infer that.

Consider the following use case: You get 4 requests for over the age of 21 credentials all coming from IP addresses in a particular area of Washington DC loaded with bars between 10pm-1am.

More likely than not, that person is bar hopping.

[David-Chadwick]

As a holder, I would question why
a) 'over 21' should be a short lived credential in the first place, and
b) object strongly to it being a one-time-use credential.
This is certainly an example of finding a more privacy friendly issuer.