Month: April 2014

On April 7th, a major web vulnerability called “Heartbleed” was disclosed to the internet. This vulnerability affected a popular security library called OpenSSL, and as a result it affected the security of a large number of sites on the internet, including Splitwise. (A good rundown of who was affected can be found here.)

Shortly after noon on April 8th, the bug was patched on all of our servers. We also issued a new SSL certificate for splitwise.com and initiated the expiration of our old SSL certificate. As a result, we are no longer vulnerable to Heartbleed.

We have no reason to believe that any Splitwise user data was compromised via the Heartbleed vulnerability or that we were the target of an attack, but we are continuing to monitor for any unusual behavior. In addition, we’ve taken this opportunity to implement a few additional security measures, to update passwords for important server components, and to generally review how we respond to security issues.

In summary:

1. The Heartbleed bug was patched shortly after 12pm EDT on Tuesday, April 8th. We issued new a SSL certificate a few hours later, and also revoked our old certificate.

2. As a precaution, we are logging out all users who visited the Splitwise website on April 7th and 8th.

3. Changing your password is recommended as a precaution, especially for users who logged in or created an account during the affected period. You can also log out of all your existing Splitwise sessions by clicking here.

The Splitwise team is excited to announce a new Settle Up option: Settle Up via drone. It’s the fastest, easiest way to collect money from your friends, no matter where they are. Plus, you’ll never need to have an awkward talk about repayment again — just send the drone and your friend will get the message that you need your money back, loud and clear.

How does it work?

If a friend owes you money, ‘Dispatch Drone’ will be an option in the Settle Up flow. Tapping ‘Dispatch Drone’ automatically deploys one of our payments-processing drones, stored in Amazon warehouses across the country. Geolocators built into your friend’s Splitwise app pinpoint their exact location, sending the drone in the right direction.

Splitwise collection Drones are equipped with Square Readers, and also take cash. As soon as your friend Settles Up with the drone, the payment is recorded in Splitwise and your balance updates accordingly. Our drones are adaptive and persistent; if your friend doesn’t have any money on them, the drone follows them around in a friendly, unobtrusive manner until they have their wallet on hand.

It’s been wonderful to collaborate with Amazon and Square on this project. We’re so glad these big companies share our commitment to eliminating money stress between friends. Stay tuned for the release of our Google Glass integration, which will project a balance onto your friends’ forehead if they owe you money.