Microsoft Makes Biggest Screwup Ever. Everyone locked out of their Microsoft Money Files

Microsoft ^ | 2/28/2004 | Me.

[Smogger]

Anyone who logged into their Microsoft Money file between Monday (8/26/2004) afternoon and Tuesday (8/27/2004) morning and logged out again has been locked out of their money file. They are going crazy on the newsgroups about this and people are calling the WSJ and ABC news and anyone else they can think of to resolve the problem.

I have already spent an entire day installing and uninstalling and restoring backups. Hopefully I haven't screwed up my money file because as it turns out there is nothing wrong with the file or the backups at all.

From Microsoft:

----------

Subject: Users locked out of their local Money file From: "Russ Paul-Jones" Sent: 7/28/2004 3:47:26 PM

Redmond, July 28, 2004, 15:45 PDT

Here at the Money team we are sorry that we have caused this problem, and we are working as quickly as possible to fix this unfortunate situation.

Let me take a moment to explain what the Money team is doing about this problem. First, let me assure you that none of your financial data has been lost, and none of your personal information has been compromised. In fact, the result of the situation has been that your information has been locked up more tightly.

Here is what happened, and an analogy to help explain it. On Monday, one type of our servers was updated and inadvertently pointed to the wrong location to verify authentication. The authentication process worked perfectly - we caused the problem by looking in the wrong server location. This mistake only affected Money services. (If you think of your login information as a key, and our servers as a lock, then we changed the lock on the safe, and the old key wouldn't work anymore. There is no way for the user [or anybody else] to create working login information. The good news is that nobody could open the local file because of this mistake at any time; your information is still protected.)

We corrected the "wrong server location" problem Tuesday morning, and users who did not login between late Monday afternoon and Tuesday morning should be able to use their files normally.

Those who were affected may continue to be affected, however, since Money downloaded some of the garbled information from our servers. (Basically, we made a copy of the lock on your local file. Why did we do this? Because when you change the lock yourself, you don't want the old key to continue working on your local file. You also wouldn't want there to be an easy way for somebody on your machine to ignore the change in the locks. Of course, we will look at this scenario to see if we could solve it without decreasing security in the future.)

The next step is to fix the locks for those of you who are affected. We are putting every effort into a solution to this problem, which we will deliver as soon as possible. We expect to be able to address every user that we affected. I'll use this newsgroup to keep you posted.

-Russ Paul-Jones MSN Money

[yellowhammer]

This headline is wrong. It wasn't EVERYONE. Think before you post next time.

[TXnMA]

"People trust MS with their finances? I don't even like trusting them with my OS! "

[upchuck]

With all due respect, anyone who trusts ANYTHING of value to Microsoft should think twice.

Money did not have this feature several years ago. It was added later.

So, they get you to buy Money, or you use it 'cause it came bundled on your new computer. Now they gotcha. Then they add .net or Passport and rave about how much better you'll be with it. So you go for it. Now they really gotcha.

And now, they REALLY gotcha!

I'm sorry, but you're fools.

I've never used Money. Do you really need an online link to access personal files stored on your hard drive? Sounds like AOL. How utterly foolish. So if your phone line/cable/satellite goes out you can't access your personal files? Unbelievable!

[Jim Robinson]

The end is near.

[snowsislander]

www.distrowatch.org is another good place to keep an eye on.

For folks who haven't tried Linux, Knoppix gets my vote as an ideal distribution. Virtually anyone can figure out how to make a bootable live cd. They then can see if they like it or not by just booting the cd.

If you don't like it, fine, you aren't out anything except a cd and a few minutes of your time (and six hundred megabytes of bandwidth.) Knoppix doesn't modify your system unless you explicitly make it do so.

As to Palladium/TCI/et al, well, we can all see how much we can trust Microsoft with our money and passports. ;-)

I am sorry for the folks that are locked out -- I hope it isn't permanent. Even the five days mentioned on the board is double plus ungood. I looked for a few minutes at the Microsoft board, and it's hard not to feel sympathy for folks' plights; one man is on his honeymoon and needs access to funds; others are trying to run their businesses and close out the month.

Microsoft has really shot themselves in the foot with this one.

[Nick Danger]

This could turn out to be hilarious for everyone except Microsoft and the people whose files are now locked. From the tone of it, it sounds like everybody who in logged during the wrong time now has a new lock on their local files, and nobody knows what it is. Microsoft doesn't know, and the user doesn't know. And without it, no one can get in to change it.

So now the "Money team" has to figure out how to hack into their own program, and get past the niftiest lock they knew how to think up.

I don't know how long their encryption key is, but if it's 1024 bits or so, they could be looking at days to crack each one.

It's probably good that this happened. Microsoft was gonna put all this fancy Digital Rights Management stuff into Office, and that was gonna "protect your documents" and make them erase themselves after so many months, and make sure that "unauthorized people" can't read them. This is exactly the fright scenario they should be worried about... somebody makes one blunder in the wrong place, and it turns a company's entire pile of correspondence into locked-up gibberish that no one can get into.

Murphy's Law has not been repealed. It will always be there, waiting to bite us.

[longtermmemmory]

so what is it that the "want to see if it can be done?"

[Kackikat]

You are very astute Jim. Have a great day!

[Kackikat]

If you have a program to lock people out of Money, then doesn't it make sense to test to see if it works?

[Ichneumon]

Whoa. Fustercluck.

It could be worse...

Several years ago I was using the CheckFree service to pay my bills electronically. It normally worked flawlessly, but one month they had a system hiccup (they blamed it on recent Y2K changes they had made), and it repeated my July payments in August (and did the same for countless other customers).

Normally this wouldn't have been too big of a deal, but as luck would have it, in July I had taken out a bill consolidation loan, and paid off a bunch of credit cards. When those payments were "cloned" into August, the net result was that I instantly ended up many thousands of dollars overdrawn, and received dozens of overdraft charges totalling nearly a thousand dollars.

To add to the "fustercluck", not only could I not withdraw any cash from my bank to buy groceries, etc. (and my nephew had just arrived from Canada, we had planned to do touristy things with him, and those take money), but my freshly paid-off credit cards were unusable in the interim because the repeated payoffs to them had bounced (for obvious reasons) and the credit card companies put holds on the accounts.

So there I was with my bank account overdrawn, my credit cards on hold, leaving me no way to withdraw pocket money for any reason.

To add to the screwups, a year or so prior to that, my bank had changed their routing numbers, and when CheckFree finally sorted out the mess and tried to credit my money back to me, the wire transfer bounced because they still had the old routing numbers.

It took almost two weeks before the mess was straightened out, and CheckFree ended up paying all my bounce fees, wrote letters to all creditors and financial institutions involved explaining that the bounces were their fault, and in no way mine, sent me a letter personally signed by their CEO, and sent us a huge mail-order cookie basket (from Cheryl & Co., nice place) to try to atone for the mess.

All in all, having my information "locked" for a few days would have been nothing in comparison.

[Kackikat]

No because Gold will be useless then.

[Kackikat]

I only gave you what I have read over the years in foreign papers....do what you want with it. Maybe if you understood what it meant for Clinton to be a Rhodes Scholar you would be better informed.