[danShumway]

> Shouldn't we

> you do not

I don't think this answers the question. Of course unsolicited pen testing is already illegal; that's not an interesting question imo. What I'm more curious about is security industry opinions about whether or not the current law is a good idea.

Are there any changes you would make to the law if you had the ability to do so, or do you see a more general danger in allowing customers to attack their own accounts?

[tptacek]

I would change the way CFAA charges are sentenced. I would not eliminate the general prohibition on hacking other people's computers.