Users locked out of their local Money file

Redmond, July 28, 2004, 15:45 PDT

Here at the Money team we are sorry that we have caused this problem, and we are working as quickly as possible to fix this unfortunate situation.

Let me take a moment to explain what the Money team is doing about this problem. First, let me assure you that none of your financial data has been lost, and none of your personal information has been compromised. In fact, the result of the situation has been that your information has been locked up more tightly.

Here is what happened, and an analogy to help explain it. On Monday, one type of our servers was updated and inadvertently pointed to the wrong location to verify authentication. The authentication process worked perfectly - we caused the problem by looking in the wrong server location. This mistake only affected Money services. (If you think of your login information as a key, and our servers as a lock, then we changed the lock on the safe, and the old key wouldn't work anymore. There is no way for the user [or anybody else] to create working login information. The good news is that nobody could open the local file because of this mistake at any time; your information is still protected.)

We corrected the "wrong server location" problem Tuesday morning, and users who did not login between late Monday afternoon and Tuesday morning should be able to use their files normally.

Those who were affected may continue to be affected, however, since Money downloaded some of the garbled information from our servers. (Basically, we made a copy of the lock on your local file. Why did we do this? Because when you change the lock yourself, you don't want the old key to continue working on your local file. You also wouldn't want there to be an easy way for somebody on your machine to ignore the change in the locks. Of course, we will look at this scenario to see if we could solve it without decreasing security in the future.)

The next step is to fix the locks for those of you who are affected. We are putting every effort into a solution to this problem, which we will deliver as soon as possible. We expect to be able to address every user that we affected. I'll use this newsgroup to keep you posted.

-Russ Paul-Jones
MSN Money