> Well, the real risk here is that it creates a new consequence for being hacked by a criminal, right. No disagreement from me here, which was one reason we se

> Well, the real risk here is that it creates a new consequence for being hacked by a criminal, right. No disagreement from me here, which was one reason we set out to talk about RansomPKP at BH/DC in the first place :) That said, I do think this can, and should, be reported to site owners. You're not going to see much innovation if people don't take time to futz around with technologies and see what they can do with them. HPKP has plenty of potential to hurt, but as you alluded to, it's generally just your own feet in harm's way. > This particular risk though just wallops the owners of the site. Yeah, that's what the (cough) team was going for.