Warning! Don't sync your ilok account

[musicman691]

Originally Posted by Carl Kolchak

I'm not saying it is Heartbleed - but as soon as Heartbleed was discovered, I checked the security of ilok.com, and found it was unsecure. It's only just been secured, and there's been no news from PACe on the subject whatsoever.

snippage

Furthermore, it's only prudent to change your password, now that ilok.com is secured.

How did you find out iLok.com was unsecure? Furthermore how did you find out it is now secure? This kind of info would help a lot of us.

Related question: my ZDT is due for renewal in a couple of weeks. I wonder how that will be affected by this malarkey?

[DigiTechSupt]

Originally Posted by musicman691

I just checked my account and most everything looks okay but:
I show two Pro Tools 11 Bundles - one is Type Trial/Demo with an expiration of July 21 2013 and the other is Type License with no expiration. I don't remember having a demo of PT10 or 11 though.

So you are saying you did not sign up for the PT11 Trial on 6/21/2013?

Thanks,
JC

[BondAudio]

FYI
Six days ago I asked iLok about Heartbleed.
Their reply:

iLok.com Technical Support
Apr 11 (6 days ago)
Hello,

Thanks for asking; your concern is certainly understood. I'm happy to say that the iLok.com site and activation are not affected by the Heartbleed vulnerability. There is no exposure or danger for any end-user or customer using our site or tools.

Best Regards,
K. Bosserman
iLok.com Technical Support
<http://www.ilok.com>

[musicman691]

Originally Posted by DigiTechSupt

So you are saying you did not sign up for the PT11 Trial on 6/21/2013?

Thanks,
JC

Yes. It's not showing up on my iLok here.
Also not showing on my iLok is a separate PT10 asset; just the PT11/10 Bundle asset (along with other license assets I legitimately have). I originally purchased my 11 Rack and that came with PT10 and didn't that asset actually become part of the PT11/10 Bundle?

[DigiTechSupt]

Originally Posted by musicman691

Yes. It's not showing up on my iLok here.

I see a Pro Tools 11 Bundle Trial/Demo in your account (not on an iLok) that was deposited 6/21/2013 and expired 7/21/2013.

Also not showing on my iLok is a separate PT10 asset; just the PT11/10 Bundle asset (along with other license assets I legitimately have). I originally purchased my 11 Rack and that came with PT10 and didn't that asset actually become part of the PT11/10 Bundle?

I see a Pro Tools 10 license in your account deposited 10/29/2012 and its status is "Surrendered." Did you upgrade that to the Pro Tools 11 Bundle on 10/9/2013?

Thanks,
JC

[musicman691]

Originally Posted by DigiTechSupt

I see a Pro Tools 11 Bundle Trial/Demo in your account (not on an iLok) that was deposited 6/21/2013 and expired 7/21/2013.



I see a Pro Tools 10 license in your account deposited 10/29/2012 and its status is "Surrendered." Did you upgrade that to the Pro Tools 11 Bundle on 10/9/2013?

Thanks,
JC

Interesting on the first one. Wonder why it's not showing on my iLok?

Yes to the second question.

Thanks for your quick help on this.

[Carl Kolchak]

Originally Posted by iLoksupport

It looks like there is some speculation and misinformation being posted here so we'd like to clear up what is going on.

First, the entire iLok ecosystem was unaffected by the Heartbleed vulnerability. This includes the iLok.com website, the iLok License Manager application, and our license activation services. Our site and services are running smoothly without any problems.

Second, we did send emails to a small number of iLok users regarding license deposits that were made to their accounts by mistake. These users were not randomly chosen, we actually audited every single license to carefully identify only those that were mistakenly deposited.

If you didn't receive an email from us, there were no mistaken deposits identified in your account. But since there seems to be so much speculation and concern by those who were not affected, we're happy to share more information here.

The license deposits that we sent emails about were deposits created by our server, NOT deposits made to an iLok account by a software publisher. These deposits were made when our server saw an iLok but failed to recognize the licenses on that iLok as the very same licenses that already were listed in the iLok account. This created a duplicate of the license, and in some cases, created a full license when what was actually seen on the iLok was an expired license.

This means that the licenses that are being removed are duplicate licenses that should never have been deposited.

So what does this mean for you?

If you didn't get an email from us, that means nothing was changed in your iLok account.

If you did get an email from us, your email lists the licenses that were mistakenly deposited. If the license is currently activated on an iLok, we told you which iLok the license is on, and how to return it. Only the licenses listed are set to be returned.

Several of the posters here had purchased this type of license from another iLok user. Unfortunately we can only direct them back to the party that they purchased the duplicate license from.

We’d like to take this opportunity to publicly apologize to the iLok users who received the mistaken deposits for any inconvenience this may have caused.

Again, if you didn't receive an email from us, your account was not changed in any way.

We hope this helps clear up the questions and worries being posted here. Our support team has been answering the questions of the affected users that have written in to us, and will continue to do so.

So you're saying that your server mistakenly deposited duplicate assets in a number of users accounts, and in several cases those users ("user A") spotted the duplicate, and decided to sell it to a 3rd party ("user B")?

The 3rd party legitimately purchased the license, and when you realised your mistake, rather than retrieving the remaining (original) asset from "user A", who was clearly acting fraudulently, you instead let them keep their original asset, and chose to penalise "user B" who had made a legitimate purchase - entirely above board.

What would you have done if "user A" had sold their original asset, and kept the duplicate asset for themselves?

If my bank makes a clerical error, and deposits £250,000 in my account, and I subsequently spend the cash on bananas, all of which I eat...

... when my bank notices it's own error, I either have to return the money, or I'm going to jail.

My bank does not say "Lucky break kid. pig out, we're going after the banana guy." and subsequently recoup the money by suing the greengrocer that sold me the bananas.

You're penalising the wrong people.

I recognise that most of the retrieved assets are being recovered from the same accounts they were inadvertently deposited in in the first place, and were never sold on. In such cases, recovery of the duplicate asset is entirely reasonable.

In such cases that the duplicate asset was sold, you really need to either broker a refund, from the user who fraudulently sold an asset they never legitimately owned, to the user who bought it through legitimate channels in good faith.

Alternatively, you need to move the remaining (original) asset from the account of "user A", and deposit it in the account of "user B".

You have the opportunity to do the right thing by your userbase, and the plug-in vendors.

[rantanplan]

Originally Posted by iLoksupport

The license deposits that we sent emails about were deposits created by our server, NOT deposits made to an iLok account by a software publisher.

If the legitimate owner of a license sells it to me, and then still has a copy in his account because of troubles with YOUR server

WHY iLok deletes both licenses (his and MINE)?

This makes no sense.
iLok is responsible for this chaos and has to care for a fair solution.

I will not sync until I got my Crane Song Pheonix back!

[rantanplan]

Originally Posted by Carl Kolchak

... when my bank notices it's own error, I either have to return the money, or I'm going to jail.

I think that's not even true...
Well, probably this depends on the country you live in. But I'm quite sure that there was a precendent in Germany where some guy spent the money and was discharged.

[DigiTechSupt]

Originally Posted by rantanplan

If the legitimate owner of a license sells it to me, and then still has a copy in his account because of troubles with YOUR server

WHY iLok deletes both licenses (his and MINE)?

That's not the case. These are licenses that expired (Trials), were surrendered (upgrades), or transferred (sold) and were later inadvertently 'restored' in the original account. If sold, the seller didn't still have a license as it was transferred to the buyer.

I've started support cases for folks here that said they have lost licenses, so please reply if you are affected by this.

Thanks,
JC