The Mandating Honeypots Project
This project demonstrates that age-verification via the Linux D-Bus interface can be trivially defeated: a simple Python script anyone can copy and paste makes the D-Bus interface always report 18+, rendering such checks useless. It argues the only reason to want ID verification is as a surveillance honeypot, and proposes a heavily redundant password-protected tool parents could use to keep kids from tampering with the verification service. Planned follow-ups include a mobile device version, an ID-database-focused version, and possibly a Windows version once the 'GetUserAgeRangeAsync' API ships.
What it addresses
Age verification that asks the D-Bus interface is useless because anyone can tell it to always report 18+; the real driver for ID verification would be mass surveillance (a 'honeypot'), and governments justify it as 'for the kids'.
Shared over time
Each entry reflects what was shared on that date. Details may have changed since then.
The Mandating Honeypots Project
This project demonstrates that age-verification via the Linux D-Bus interface can be trivially defeated: a simple Python script anyone can copy and paste makes the D-Bus interface always report 18+, rendering such checks useless. It argues the only reason to want ID verification is as a surveillance honeypot, and proposes a heavily redundant password-protected tool parents could use to keep kids from tampering with the verification service. Planned follow-ups include a mobile device version, an ID-database-focused version, and possibly a Windows version once the 'GetUserAgeRangeAsync' API ships.
Problem: Age verification that asks the D-Bus interface is useless because anyone can tell it to always report 18+; the real driver for ID verification would be mass surveillance (a 'honeypot'), and governments justify it as 'for the kids'.
Audience: Parents (users of the proposed tamper-protection tool)
Posted by @ToriTech · Original comment ↗
“I put together this thing I call The Mandating Honeypots Project and it shows how anyone with an internet connection and copy + paste skills can trick Linux D-Buses with a simple Python script, proving that if companies want to verify your age by asking the D-Bus interface, it's easy to just tell it to always send 18+, making the whole thing useless.”