Back to all posts

Heartbleed Bug

Along with many other sites on the internet, Quantopian is taking steps to protect ourselves from the "Heartbleed Bug", which was disclosed yesterday. Although we have no reason to believe that our site or any of our members' accounts or data have been compromised, we are taking a number of precautions to safeguard the security of our members' accounts. We will be documenting here the steps we are taking.

[DONE] We are generating a new SSL certificate to protect our site, using a newly generated encryption key; deploying the new key and certificate to our servers; and asking our SSL certificate authority to revoke our old certificate.

[DONE] We are adding a prominent banner within our application notifying all members to change their passwords. The banner will go away automatically when the user's password is changed.

[DONE] We are requiring all members who have brokerage accounts configured within Quantopian to change their passwords.

[DONE] We are modifying our application so that members are not able to configure a brokerage account within Quantopian until they have changed their password.

[DONE] We are rotating the passwords and encryption keys used by the components of our application when they are communicating with each other. This requires application down-time the evening of April 8, 2014, starting at 5:00pm US/Eastern.

[DONE] We are generating new encryption keys used to protect data in our databases and re-encrypting all data using the new keys.

 

The material on this website is provided for informational purposes only and does not constitute an offer to sell, a solicitation to buy, or a recommendation or endorsement for any security or strategy, nor does it constitute an offer to provide investment advisory services by Quantopian.

In addition, the material offers no opinion with respect to the suitability of any security or specific investment. No information contained herein should be regarded as a suggestion to engage in or refrain from any investment-related course of action as none of Quantopian nor any of its affiliates is undertaking to provide investment advice, act as an adviser to any plan or entity subject to the Employee Retirement Income Security Act of 1974, as amended, individual retirement account or individual retirement annuity, or give advice in a fiduciary capacity with respect to the materials presented herein. If you are an individual retirement or other investor, contact your financial advisor or other fiduciary unrelated to Quantopian about whether any given investment idea, strategy, product or service described herein may be appropriate for your circumstances. All investments involve risk, including loss of principal. Quantopian makes no guarantees as to the accuracy or completeness of the views expressed in the website. The views are subject to change, and may have become unreliable for various reasons, including changes in market conditions or economic circumstances.