> Shouldn't we > you do not I don't think this answers the question. Of course unsolicited pen testing is already illegal; that's not an interesting question

> Shouldn't we > you do not I don't think this answers the question. Of course unsolicited pen testing is already illegal; that's not an interesting question imo. What I'm more curious about is security industry opinions about whether or not the current law is a good idea. Are there any changes you would make to the law if you had the ability to do so, or do you see a more general danger in allowing customers to attack their own accounts?