[raron]

> Use short expirations

And now you can use time correlation attack to unmask people.

[DennisP]

How? The websites don't see anything consistent from one session to the next. They can't tell when the credential is renewed, and don't see a credential id.