Warn about using too many decoys.

Author: msporny

index.html

@@ -1168,18 +1168,26 @@ <h3>Content Distribution Networks</h3>
       <h3>Decoy Values</h3>
 
       <p>
-The use of decoy values in status lists by <a>issuers</a> can increase the
-privacy of <a>subjects</a> by further hiding the size of the group associated
-with a status list as well as when values in the list change. When employing
-decoy values, it is important to ensure that the decoys behave like real
-entries in the group. For example, if a decoy is used for revocation, it would
-be strange to flip the decoy value to "unrevoked" when that is not how the
-rest of the revocation values associated with real entries behave. Similarly,
-changing the decoy values at times and numbers that do not align with the way
-real entries behave can enable statistical analysis to separate the real
-entries from the decoy entries. While algorithms for employing decoy values
-are out of scope for this specification, the usage of decoy values is an
-important part of an <a>issuer's</a> privacy protections for their
+The use of decoy values in status lists by <a>issuers</a> can, when used
+properly, increase the privacy of <a>subjects</a> by further hiding the size of
+the group associated with a status list as well as when values in the list
+change. It is also possible to use too many decoys, thus reducing the group
+privacy size by the number of decoys added to a group. The proper number of
+decoys to use is a function of the desired group privacy size, the randomness
+of the distribution of entries in the set, and ensuring that entities watching
+the list cannot determine which entries are real and which ones are decoys as
+they change throughout time.
+      </p>
+      <p>
+When employing decoy values, it is important to ensure that the decoys
+behave like real entries in the group. For example, if a decoy is used for
+revocation, it would be strange to flip the decoy value to "unrevoked" when that
+is not how the rest of the revocation values associated with real entries
+behave. Similarly, changing the decoy values at times and numbers that do not
+align with the way real entries behave can enable statistical analysis to
+separate the real entries from the decoy entries. While algorithms for employing
+decoy values are out of scope for this specification, the usage of decoy values
+can be an important part of an <a>issuer's</a> privacy protections for their
 <a>subjects</a>.
       </p>
     </section>