This is why I don't like metaphors :)) In any case, password or not is not the problem. EU law actually has protections for white hat hackers, even when they a

This is why I don't like metaphors :)) In any case, password or not is not the problem. EU law actually has protections for white hat hackers, even when they actually hack. I do have a friend who does this regularly, he's been in the press, he's been sued, he knows the drill. There are a number of steps to follow, and a 3-day wait period is patently absurd. A proper process looks absolutely nothing like this. Amongst other things, my friend is actually contacting the authorities before even considering public disclosure. The point of a white hat hacker is to help, not to make things worse.