Mandating-Honeypots-Project

As laws like the Parents Decide Act (H.R.8250) and California's Digital Age Assurance Act (Assembly Bill 1043) move through legislative bodies, privacy, anonymity, and data security becomes laden with systemic threats and new security architecture with unexamined attack surfaces. If passed, such legislation would quite literally mandate the existence of honeypots for determined attackers by demanding sensitive information (such as a government-issued ID) from anyone who wishes to use a computer. This not only endangers the very minors these laws claim to protect, but also provides a very clear attack surface: compromise the databases that house those digital IDs, and you will have suddenly stolen a thousand new identities.

The Mandating Honeypots Project seeks to prove that invasive ID verification is not the only solution. It will do so by posting audits of digital identity verification systems, related position papers, POCs, and prototype applications that simultaneously identify vulnerabilities and offer decentralized, privacy-preserving solutions. This project, designed to demonstrate vulnerabilities within Linux D-Buses (an integral part of the California Digital Age Assurance Act) was deemed "finished" on 5/6/26. With the recent introduction of the SCREEN Act, more specialized research is likely to follow.

There are three phases to this project:

Phase 1

• Objective: Analyze the systemic risks of centralized Digital ID systems.
• Deliverables:
  • Position Paper: "Mandating Honeypots: How Digital ID Verification Poses More Threats Than It Prevents, And How ZKPs Can Offer A Solution."
  • Scope: An analysis of recent age-verification mandates such as the Parents Decide Act and the California Digital Assurance Act, explaining the inherent risks and offering a solution found in Schnorr-based ZKPs.
  • Proposing Zero-Knowledge Proofs (ZKPs) as a privacy-preserving "last resort" for verification, should it become required by law.