Users locked out of their local Money file
Redmond, July 28, 2004, 15:45 PDT
Here at the Money team we are sorry that we have caused this problem, and we are
working as quickly as possible to fix this unfortunate situation.
Let me take a moment to explain what the Money team is doing about this problem.
First, let me assure you that none of your financial data has been lost, and none
of your personal information has been compromised. In fact, the result of the situation
has been that your information has been locked up more tightly.
Here is what happened, and an analogy to help explain it. On Monday, one type of
our servers was updated and inadvertently pointed to the wrong location to verify
authentication. The authentication process worked perfectly - we caused the problem
by looking in the wrong server location. This mistake only affected Money services.
(If you think of your login information as a key, and our servers as a lock, then
we changed the lock on the safe, and the old key wouldn't work anymore. There is
no way for the user [or anybody else] to create working login information. The good
news is that nobody could open the local file because of this mistake at any time;
your information is still protected.)
We corrected the "wrong server location" problem Tuesday morning, and users who
did not login between late Monday afternoon and Tuesday morning should be able to
use their files normally.
Those who were affected may continue to be affected, however, since Money downloaded
some of the garbled information from our servers. (Basically, we made a copy of
the lock on your local file. Why did we do this? Because when you change the lock
yourself, you don't want the old key to continue working on your local file. You
also wouldn't want there to be an easy way for somebody on your machine to ignore
the change in the locks. Of course, we will look at this scenario to see if we could
solve it without decreasing security in the future.)
The next step is to fix the locks for those of you who are affected. We are putting
every effort into a solution to this problem, which we will deliver as soon as possible.
We expect to be able to address every user that we affected. I'll use this newsgroup
to keep you posted.
Back to Russ' Responses Article List