Microsoft terminated the account VeraCrypt used to sign Windows drivers

https://sourceforge.net/p/veracrypt/discussion/general/thread/9620d7a4b3/

by super256 • 4 months ago

1297 487 4 months ago

dizhn• 4 months ago

Microsoft disabled the developer's certificate so no windows releases can be made.

As someone who is just planning to publish signed desktop software for Windows, this is deeply worrying. What reasons could there be for cancelling a certificate, especially when it has been used for years and the identity is already established?

Are there some ways to combat such decisions legally?

politelemon• 4 months ago

This is a concern and risk that has realised itself multiple times over the past decades. There have been multiple stories linked to multiple developers in the past.

If you publish to any closed platform including ios, mac, win, android, this is the risk you run and a condition of operating you will need to accept.

shelled2• 4 months ago

Realistically speaking - anything could be a reason. A shakedown or blocking based on some "nudge" (this might come across as tin-foiled though). Some flag/trip-wires going wrong, more worryingly due to a bug/false alarm - and this is more worrying because in this case semi-incompetent large orgs like MSFT find it really hard to accept it, fix, and move on. Some change in OP's account that either they don't see or haven't realised - some edge case, you never know.

And of course, it doesn't affect their earnings and there are no consequence, or significant, so they won't care and won't respond or tell what went wrong.

Can one move legally? Sure. But then it effectively is a combo of who blinks first and who can hold their breath longer.

technion• 4 months ago

There's more to it. Signed desktop software can be signed by any CA.

Veracrypt has kernel drivers. Microsoft's ability to control what you can sign is specific to kernel drivers, and Microsoft's trigger finger around bans exists in the world where bad drivers BSOD machines.

In general this isn't your problem.

actionfromafar• 4 months ago

You just have to start living like they do in Russia and comply in advance. Don't do anything "interesting", no encryption, or if you do, make sure you leave breadcrumbs, scratch that, a bread trail for them to easily get access to customer data. An Oracle or Sharepoint integration maybe?

electroly4• 4 months ago

Perhaps not legally, but technically, you have an option: don't use the Microsoft Store. This isn't as wild a suggestion as it may seem to non-Windows users: the store is barely used by Windows users. You can get your own code signing certificate from a public CA, sign your own installer, and post it on your website. This is still the primary way that Windows software is distributed. Microsoft does not have a hand in any part of it; they can't cancel anything. Their only role is including the public CA in their root certificate store. If you're not shipping a kernel driver, you don't need Microsoft's permission for anything. You can still ship an .msix installer which is the same technology used by the Store.

I recently de-listed my app in the store and closed my Microsoft developer account. I was wrong for having bothered with it; just a waste of my time for no benefit. Stick to your own deployment.

lossyalgo2• 4 months ago

According to this: https://x.com/EdgeSecurity/status/2041872931576299888

...it seems like they instituted an identity verification policy, didn't notify me about it, and then I guess they suspended accounts who didn't do the verification.

So, make sure you verify your account? Check spam folder regularly? Log in via web interface at least once a year?

Gareth3212• 4 months ago

We can still install, right? It just comes up with a scary warning. Still not great but at least we aren't locked out.

Strom• 4 months ago

You can, but it's more than a warning. VeraCrypt has a signed kernel driver, which has higher requirements. You'll need to boot into a special Windows mode and disable Driver Signature Enforcement.

ErroneousBosh4• 4 months ago

Jesus, sourceforge is still on the go?

SXX• 4 months ago

Might be it even not using all your code to train AI. Or at least not asking your explicit permission to do it.

karel-3d• 4 months ago

sourceforge was always very scummy, I think they would definitely use the code for that if they could

JimDabell2• 4 months ago

Not every conversation has to be a conversation about AI.

egorfine3• 4 months ago

And unfortunately some projects exclusively use sourceforge. Which breaks some of my CI pipelines.

yjftsjthsd-h2• 3 months ago

Why would that break CI?

kome• 4 months ago

yeah, it just works

tvbusy• 4 months ago

I understand that most people want to move to other more modern tools, it's up to you. However, what baffled me is why the author's choice not to move is a problem? Did we pay them to move and they did not move as promised? Was there some crowd funding to move that was not fulfilled?

IshKebab• 4 months ago

what baffled me is why the author's choice not to move is a problem?

Because Sourceforge is horrible to use and was at one point actively pushing malware? It's pretty obvious tbh.

ErroneousBosh4• 4 months ago

I just didn't think Sourceforge was still running. There was a mass exodus from it about 20 years ago when it became a massive ad farm that started injecting ads into people's tarballs.

It was never as good as freshmeat.net even in its heyday.

firen777• 4 months ago

It's like LibreOffice all over again: https://www.neowin.net/news/microsoft-bans-libreoffice-devel...

SeanDav5• 4 months ago

This is worrying on many levels. So Microsoft force you to create an account to use Windows and then they reserve the right to block you from your own account, thereby potentially making you lose access to all your OWN data. This is crazy and yet another reason to stop using Windows as soon as possible.

xorcist2• 4 months ago

It's not your own data anymore if you gave it away.

criddell• 4 months ago

Or create the account but don't use Microsoft services.

jerf• 4 months ago

I know it's not what people want to hear but my response to a lot of the comments here is just a general, I agree, it's time to stop using Windows.

They won't let you secure your drive the way you want. They won't let you secure your network the way you want (per the top-level comment about Wireguard). In so doing they are demonstrating not just that they can stop you from running these particular programs but that they are very likely going to exert this control on the entire product category going forward, and I see little reason to believe they will stop there. These are not minor issues; these are fundamental to the safety, security, and functionality of your machine. This indicates that Microsoft will continue to compromise the safety, security, and functionality of your machine going forward to their benefit as they see fit. This is intolerable for many, many use cases.

I think it is becoming clear that Microsoft no longer considers Windows users to be their customers any more. Despite the fact that people do in fact pay for Windows, Microsoft has shifted from largely supporting their customers to out-and-out exploiting their customers. (Granted a certain amount of exploitation has been around for a long time, but things like the best backwards compatibility in the industry showed their support, as well.)

I suspect this is the result of a lot of internal changes (not one big one) but I also see no particular reason at the moment to expect this to change. To my eyes both the first and second derivative is heading in the direction of more exploitation. More treating users like a cattle field and less like customers. When new features or work is being proposed at Microsoft, it is clear that it is being analyzed entirely in terms of how it can benefit Microsoft and users are not at the table.

No amount of wishing this wasn't so is going to change anything. No amount of complaining about how hard it is to get off of Windows is going to change anything; indeed at this point you're just signalling to Microsoft that they are correct and they can treat you this way and there's nothing you will do about it for a long time.

BLKNSLVR• 4 months ago

Correction: stop using Microsoft products as soon as possible.

gzread6• 4 months ago

Google and Apple have been doing this for a long time, and Microsoft clearly got jealous.

Their first big win was when they banned the Chief Prosecutor of the International Criminal Court from accessing any of the court's documents, then deleted all of those documents. Now they're going after slightly less important enemies of the state. That bar will continue to drop as long as it's allowed to. And let's not kid ourselves: if you develop or use encryption software that Mossad can't break, you are an enemy of the state.

whyoh• 4 months ago

That probably had nothing to do with LibreOffice. Lots of people have had their MS accounts locked for no reason. I guess the automatic abuse detection system just sucks.

My advice is don't use a MS account if you can, at least not for anything critical. You don't need it for development, you can use 3rd party CAs for signatures.

pogue2• 4 months ago

They need to get some tech site like Arstechnica to write about it, like they did when neocities couldn't get ahold of bing. The only way to contact these tech companies to speak to a real human being and not a chatbot is if you know somebody who works there or if the media writes about it.

CR1337• 4 months ago

I blew the lid on X today:

https://x.com/i/status/2041698657368703484

bombcar4• 4 months ago

The (new?) X link made me think for a moment you got the username @i

klabb33• 4 months ago

It's much worse than you think. Press coverage -> manual intervention is at best a bandaid covering up a major wound in a flaw that happens with independent software distribution.

The old model where the user decides which software or apps to run on their machine, is basically already replaced by a whitelist system that is managed by companies who have no interest or obligation to approve developers. Factors like ”being an individual”, an open source developer or god forbid reside outside the USA, you rely on a combination of L1 support doom loops, unjustifiable high recurring prices, kafkaesque and changing requirements, internal inconsistencies. Windows is the worst, but all platforms (except Linux) suffer from this and you can and will get hurt, delayed, and gaslit. If you haven’t, it’s just a matter of time.

I have been blocked for 6 months now with Digicert code cert renewal, for my app Payload, which will never get any media attention. The app doesn’t matter though, the approval process is per-entity (usually, a company). The point is that nobody gives a shit, because they have a monopoly/cartel and they start the validation process after they take your money.

If you are not an app publisher, the best way I can describe it is the ”pre-let’s encrypt” era of SSL certs, but more expensive, strict and ambiguous. In fact, I’ve never gone through any worse approval process in my life, and that includes applying for residency in two countries, business licenses, manual tax filings etc.

bluGill2• 4 months ago

Some countries (the EU in general) are already doing things about this. Owning the app store means you are a monopoly and now the only question is are you illegal by the local laws which vary.

You can/should write your congressman (or whatever they are called in your country) and get better laws in place.

perlgeek• 4 months ago

Isn't this Microsoft abusing their quasi-monopoly as a consumer PC OS vendor?

If it weren't for the current administration, I'd say it's time for regulatory action.

riskable3• 4 months ago

The time for regulatory action against Microsoft was thirty years ago and the need for it has only grown since then.

The FTC wasn't doing their job between 1980-2020 because of their ridiculous standard of, "if it doesn't raise consumer prices, it must be allowed." This lead to massive consolidation in many industries which of course ended up raising prices and hurting consumers anyway.

Recently they've had some wins but overall they're still failing to do their job.

newsoftheday6• 4 months ago

If it weren't for the current administration

Because the Democrats were better at keeping them on a leash? No. Clinton was in charge 30 years ago and blew it.

account4224• 3 months ago

Because the previous administration(s) regulated MS so much that they aren't too big to fail now?

ninjagoo2• 4 months ago

Looks like Linux and some of the BSDs are the only remaining truly open OSes.

krylon3• 4 months ago

True, however, that has been the case for quite a while. This particular incident doesn't change that, except for the VeraCrypt developer, who is in a crappy situation now (not just regarding VeraCrypt, he mentions he was using the certificate for his main job as well, so this sucks a lot for him).

sph2• 4 months ago

Well, of course. Have the other commercial offerings every been "truly open OSes"?

Aachen2• 4 months ago

So far I haven't had much concrete reason for my family to switch away from Windows. The updates maybe, needing to pay for a new license and the UI changes are like pulling the chair out from under them, especially as they get older (Windows 7 was hard for my grandma, thankfully they left 10 mostly alone but 11 is quite different again so she's currently staying on 10 — not that her hardware supports 11 anyway but that's fixable), but it's either learning the new Windows UI, let's say ten storypoints of newness, or learning some Linux desktop environment, even if it's Mint which is similar to 7/XP it's not quite the same either and probably like 15 storypoints at minimum, even if then you're done for much longer

But if OSes are being locked down and software has trouble distributing security updates through official repositories for Windows... that's a good reason to finally make the switch. Same as why my family is on Android: I can install f-droid, disable the google store, and don't have to worry about them installing malware / spyware / adware

There's different degrees of openness. Android till 2026 was an acceptable compromise (let's see how it goed forwards). Windows is also on the decline with their account policy, not sure about this certificate revocation thing (thankfully haven't had to deal with it yet; I'm not a user myself) but it sounds like they're moving to a walled garden also

When the degree changes and gets even less open, yeah you can say "well of course, they were never truly open, they're commercial" but it's still a change and might lead people to alter their choices

SeanDav5• 4 months ago

Except compulsory age verification in Linux is now becoming a real threat. Some Linux distros are actively against this but many are not seemingly interested in fighting it: CachyOS, Ubuntu, Fedora and others.

Age Verification is the thin end of a much bigger wedge in "open" OS's

akimbostrawman• 4 months ago

the current law requires no verification at all simple attestation, you could put in _any_ age. it also does not effect linux distros as a whole, only distros in jurisdictions with the laws.

Pay088• 4 months ago

I thought community projects (as opposed to the corporate Fedora and Ubuntu) are exempt from such laws.

sunshine-o• 4 months ago

Yes time to wake up.

I really believe most "open source" big projects have been compromised long ago. We have saw all those "Foundations" taking them over with all their governance, bureaucracy and goal which do not make any sense at the first look.

One example is Fedora, which is part of "The Digital Public Goods Alliance" [0], "a multi-stakeholder initiative that accelerates the attainment of the Sustainable Development Goals by facilitating the discovery, development, use of, and investment in digital public goods."

The Digital Public Goods Alliance has about every governments as member plus all the usual suspects: Gate Foundation and co.

All the leaderships have usually no background or experience in open source or even computers but are just magically placed there. But you can't say anything because they are mostly women.

You read the goals and roadmaps of those foundations and find out it has nothing to do with software or open source. It is basically there to control those projects and then have them implement all the age verification, digital id, etc.

So yes this is not a surprise all those projects are now all in absurd features such as age verification.

- [0] https://www.digitalpublicgoods.net/

xorcist2• 4 months ago

Until Microsoft decides to no longer sign the Linux boot loader shim (for IBM/Red Hat, no less).

irusensei2• 4 months ago

In most cases you can put your computer secure boot in setup mode and roll your own keys.

egorfine3• 4 months ago

Not for long: https://news.ycombinator.com/item?id=46784572

nixpulvis2• 4 months ago

We need a better way to sign and verify software. Clearly companies like Microsoft and Apple have not been good for the open source communities and are inhibiting innovation.

PunchyHamster• 4 months ago

Just add code cert generation to letsencrypt, it's not like MS validates the code that you sign used certs from them anyway

mr_mitm3• 4 months ago

What would be the point? How would you prevent malware from being signed? Currently, code signatures are used as a signal for trustworthiness of the code.

kbolino2• 3 months ago

Actually, Windows by default will not trust code signed by CAs that issue certificates to websites. It will only trust code signed by CAs that are approved for code-signing, which isn't a very large set anymore. Moreover, recent CA/Browser Forum policies forbid dual-use CAs anyway. If Let's Encrypt issues you a certificate for a web site, it cannot be used for code signing.

It's possible that they could start issuing separate certificates upon specific request for code signing purposes, but it's doubtful they would be willing to meet Microsoft's requirements for such certificates, so their code-signing CA would not be added to Windows's trust store, rendering the certificates it issues useless.

The ACME protocol, the key automation technology that makes Let's Encrypt possible, performs domain validation only. It verifies that you, the person (or bot) making the request, are an authorized administrator of the DNS records, or port-80 HTTP server, for that domain. This is directly relevant to, and generally considered sufficient for, HTTPS.

However, domain validation is almost completely irrelevant to, and insufficient for, code signing. Microsoft's rules (and Apple's, incidentally) require establishing the identity of a legal person (individual, or preferably, company). There is no way the ACME protocol can do this, which means that the process is totally out of Let's Encrypt's wheelhouse.

account4224• 3 months ago

The same let's encrypt that recently removed support for using their certificates in clients because Google told them to?

iamniels• 4 months ago

We need better OSes such that signing of software is not required to keep your computer safe.

drewfax• 4 months ago

GrapheneOS is doing lot of things right in this regard. Robust permission system adopted from AOSP and hardening by default in every imaginable way. Things like hardened malloc, storage scopes are excellent security features. Malware cannot do much even with the default settings.

fsflover3• 4 months ago

Qubes OS is such OS: it runs everything in VMs with strong hardware isolation. My daily driver, can't recommend it enough.

layer83• 4 months ago

With a file system driver like Veracrypt, if it’s malicious, the OS might keep your computer safe, but not your files that you store in that file system.

nixpulvis2• 4 months ago

Yes, I completely agree.

account4224• 3 months ago

We need to stop trying to solve computer security entirely through technical means. We don't do that for any other kind of crime.

realusername• 4 months ago

I think this is fundamentally an unsolvable problem and I'm not even sure it's worth pursuing.

Any large scale signing platform will have large oversights and be rendered useless. See the appstore / play store/windows...

Pay088• 4 months ago

On the source code side, I quite like the way Guix does things, i.e. needing every commit to be gpg-signed. They even have a handy tool for verifying the repo[0] but I'm not sure how viable this is for non-OSS projects.

[0] https://guix.gnu.org/manual/devel/en/html_node/Invoking-guix...

tamimio2• 4 months ago

It should something like web certificates, you can bring your own.

uyzstvqs2• 4 months ago

I suggest that developers could self-sign to verify the legitimacy of future updates. Otherwise leave it unsigned.

This entire "big tech overlords have to sign apps & drivers to keep you safe" concept is one giant pile of nonsense.

speedgoose• 4 months ago

It's perhaps naive, but could he create a new organisation, like a "TotallyNotVeraCrypt" French loi 1901 association, at a different address, and create a new microsoft account by making sure it passes all the requirements.

orbital-decay• 4 months ago

That's what VeraCrypt is, a fork of the original TrueCrypt after all drama, security doubts, and eventual discontinuation. It took a long time and two independent audits to establish trust in it.

subscribed4• 4 months ago

Probably not French though, give how hostile it appears to be to encryption/security related projects (GrapheneOS had a good arguments re: that)

kijin• 4 months ago

The author is now based in Japan, and even owns a veracrypt.jp domain. Meanwhile, the old veracrypt.fr domain redirects to veracrypt.io.

Seems rather clear that he doesn't want French jurisdiction.

repelsteeltje2• 4 months ago

Yeah but isn't the point of these certificates to express trust?

The point isn't (or: shouldn't be) to forcefully find your way through some back alley to make it look legit. It's to certify that the software is legit.

Trust goes both ways: we ought to trust Microsoft to act as a responsible CA. Obfuscating why they revoked trust (as is apparently the case) and leaving the phone ringing is hurting trust in MS as a CA and as an organization.

sidewndr462• 4 months ago

who on planet earth trusts a piece of software because Microsoft signed it?

fg137• 4 months ago

And Microsoft will be happy to shut that one down because their incompetence.

So we'd better find a real solution now.

RandomGerm4n• 4 months ago

That's especially ridiculous because this whole security mechanism that Microsoft is forcing on Windows user doesn't even work. There are tons of leaked certificates and on forums dedicated to game hacking you can find guides on how to get your hands on one yourself. People there use them to write kernel drivers for cheating in games. Game developers often blacklist these in their anti-cheat software so that the game no longer launches on a computer using a driver with that certificate. Microsoft however does not do this and malware developers can then simply use the certificates for their own purposes. So all this nonsense is basically just a restriction on regular users and honest developers while the “bad guys” can get around it.

redox99• 4 months ago

That's kind of crazy. Why doesn't Microsoft revoke such certs such that you can't sign new software with it?

steve19773• 4 months ago

Because it's mostly just performative.

Deathmax• 4 months ago

Microsoft has been taking steps to mitigate the leaked code signing certificate problem.

On the driver side of things, new versions of Windows no longer trust the cross-signed certs, so you must submit your driver to Microsoft to validate and sign, so no private key to go missing. https://techcommunity.microsoft.com/blog/windows-itpro-blog/...

On the regular Authenticode side of things, the new CA/B Forum rules have prohibited storing new private keys outside of hardware modules for a while now, so eventually you won't be able to find a leaked private key for code signing that would still be valid.

shelled2• 4 months ago

I am somewhat also concerned that this software was still being distributed on SourceForge.

frizlab• 4 months ago

I don’t even understand how SourceForge still exists!

reddalo• 4 months ago

Yes, I stopped using SourceForge after they started tampering with installers to put adware inside of them.

It's a bit worrying that a sensitive app such as VeraCrypt is still distributed there.

poizan42• 4 months ago

That was 11 years ago, under DHI Group though. I don't think Slashdot Media have been up to the same shady stuff.

Pay088• 4 months ago

Why?

qwertox• 4 months ago

~2015, "DevShare". They wrapped open-source software downloads with opt-out adware and PUPs (potentially unwanted programs), without the original developers' consent in some cases. They took over abandoned/unmaintained projects (like GIMP for Windows, VLC, etc.) and replaced the original download with their adware-wrapped version.

bartvk• 4 months ago

But think about it, if they were on Github now, which is owned by Microsoft, would there be even further consequences?

luke5441• 4 months ago

Depending on GitHub and Microsofts largesse there surely is much better. See OP.

_s_a_m_• 4 months ago

Microsoft doing everything in their power to be assholes, as always

krylon3• 4 months ago

As much as I like bashing Microsoft, never underestimate people's capacity for incompetence, especially where large organizations are involved. I don't see how they would gain anything from this move.

cm2187• 4 months ago

It doesn’t help that they do that sort of shits AND mandate a microsoft account for logging in to windows. Also how much trust can you have that if you move your business to azure they will not randomly kill it. Incompetence or malice, almost doesn’t matter to the average user.

account4224• 3 months ago

And never underestimate the capacity of useful idiots for defending malicious actors.

saidnooneever• 4 months ago

maybe an old vulnerable signed driver can be used to load the new version :D. on a more seirous note, i think contact with a person at MS, likely via socials triggering that, might help here. It all depends on the reason for the ban/block/cancel.

if they had a reason other than 'oops mistake' its likely just going to remain in place. (sadly, that is how MS is. if you care for privacy maybe go to BSD)

a_paddy• 4 months ago

Who said vulnerable? Perhaps just a driver with less features.

no_time3• 4 months ago

GP refers to the practice of getting kernel level code execution using other, old vulnerable drivers and using it to run the VC driver.

zx2c45• 4 months ago

This is the same problem I'm currently facing with WireGuard. No warning at all, no notification. One day I sign in to publish an update, and yikes, account suspended. Currently undergoing some sort of 60 days appeals process, but who knows. That's kind of crazy: what if there were some critical RCE in WireGuard, being exploited in the wild, and I needed to update users immediately? (That's just hypothetical; don't freak out!) In that case, Microsoft would have my hands entirely tied.

If anybody within Microsoft is able to do something, please contact me -- jason at zx2c4 dot com.

teruakohatu• 4 months ago

I am astounded that the maintainer and inventor of Wireguard is in this position.

Microsoft even supports Wireguard in Azure Kubernetes Service.

miroljub• 4 months ago

Maybe time for a custom license that would require M$ to sign up for special T&Cs if they want to use this software?

Who cares if it's OSI-approved or not, a line saying "M$, Google, and the like need written permission for every use case" would help to make those leeches honest. Just learn from the JSLint example.

nelox3• 4 months ago

Agree. Single point of failure. One developer, one account. Crazy.

windowliker• 4 months ago

Is this another example of their old modus operandi:

https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

Already__Taken• 4 months ago

It's got a lot of analogy to restaurants banning Uber delivery for not handling their food to their standards.

onehair• 4 months ago

Now this is even more alarming! Wireguard's creator has their Microsoft account suspended...

<Tin foil hat on> Microsoft doesn't want to allow software that would allow the user to shield themselves, either by totally encrypting a drive, or by encrypting their network traffic! </Tin foil hat on>

ngetchell• 4 months ago

Or more likely, some automated security system flagged popular but suspicious apps for further review.

unicornporn• 4 months ago

Microsoft doesn't want to allow software that would allow the user to shield themselves

I don't think Microsoft cares (about anything besides making mo' money), but there are plenty of (state) actors that can influence the decision-making at Microsoft when it comes to these issues.

No tinfoil needed.

blitzar• 4 months ago

"Never attribute to malice that which is adequately explained by stupidity"

Macha• 4 months ago

Alternatively they asked copilot to scan for crypto projects and ban them

varispeed• 4 months ago

It is more likely that government doesn't want to allow people to have privacy. Microsoft just obediently listen to orders and execute them.

gib444• 4 months ago

Y'all need to form an alliance or something, get some press coverage (wireguard, veracrypt, libreoffice)

duskdozer2• 4 months ago

True, but really even if it gets resolved for them it should basically be a huge warning sign to everybody. Projects like those might get reinstated but it would only be because of how big they are that it would matter. Any person or small or 'undesirable' project would not get the same resolution.

jchw• 4 months ago

I tried to set up a partner account for driver signing last year (as a business entity) and it already seemed basically impossible. I think they're getting ready to just simply not allow it at all.

This is stupid. If Microsoft wants people to stop writing kernel drivers, that's potentially doable (we just need sufficient user mode driver equivalents...) but not doing that and also shortening the list of who can sign kernel drivers down to some elite group of grandfathered companies and individuals is the worst possible outcome.

But at this point I almost wish they didn't fix it, just to drive home the point harder to users how little they really own their computer and OS anymore.

tamimio2• 4 months ago

I think it’s intentional, those encryption (at rest/transit) applications are outside of MS control and you can assume outside of potential backdoors by three letters agencies, bitlocker vs veracrypt? Of course bitlocker is favorable from their perspective.

I wouldn’t be surprised if NSA already had a list of these applications and the strategies on how to cripple them or worse, compromise them.

nelox3• 4 months ago

Or found they’ve been compromised by someone else? ;)

pocksuppet11• 4 months ago

The other day I tried to create a Github account and was repeatedly told I am fraudulent. Nothing else. Try again later, it says.

This is the same thing that's happened every time I've tried to have a Microsoft account. I don't think Microsoft wants to have customers who aren't rich.

jandrese• 4 months ago

Maybe some bot signed up using your email and then did bot things on it. I've had that happen a lot over the years. My Microsoft account is still stuck in German because that's the language the bot used when creating the account (to spam X-Box apparently).

octoberfranklin• 4 months ago

Same here with github.

tssva• 4 months ago

Has your Apple account been suspended for the last few years?

matheusmoreira• 4 months ago

what if there were some critical RCE in WireGuard, being exploited in the wild, and I needed to update users immediately?

Honestly, anyone still using Windows probably deserves it.

iamnothere• 4 months ago

Surprised to see you here. Thanks for all your hard work.

Windows users are in a tough spot, but with the dawn of Copilot, nobody should be surprised. Frankly, those who remain with Windows after this latest betrayal have chosen their fate.

SV_BubbleTime5• 4 months ago

those who remain with Windows after this latest betrayal have chosen their fate.

Ah. So almost every single business in the world… suckers?

zx2c45• 4 months ago

Encouraged by this thread, I tweeted about it: https://x.com/EdgeSecurity/status/2041872931576299888

varun_ch• 4 months ago

If someone was a bad actor, right now would be a pretty good time to start exploiting zero days in WireGuard…

ninjagoo2• 4 months ago

It has been clear for a while that certain providers and services need to be regulated as utilities - Microsoft, Google, Apple, Visa, Mastercard, and soon Openai and Anthropic.

It should be illegal for these companies, just like utilities, to deny service to anyone or any entity in good standing for dues.

There is little hope for getting this through in the US where most politicians of any stripe hate the public, and the ones that don't have hardly any power. But it might be possible to do this in the EU.

Then, we non-EU folks need to apply for Estonian e-residency [1] which may get us EU regulatory coverage.

[1] https://en.wikipedia.org/wiki/E-Residency_of_Estonia

prox2• 4 months ago

We need a law that a human representative can be spoken to within 24 hours or directly when something critical happens.

Also “there is no appeal possible” should be plain illegal.

miohtama• 4 months ago

If it is regulated as a utility, the government will want to ban these hacking tools.

x0x0• 4 months ago

I've gotten business verification for Microsoft before. The kind you need in order to get certain oauth scopes for their O365 platform.

Do not discount complete, total, utter, profound fucking incompetence as the driving reason behind this.

Getting the business verification was an astounding shitshow. With a registered C corp and everything, massively unclear instructions, UI nestled in a partner site with tons of dead ends. And then even after all the docs, it took another week because -- in an action that nobody could possibly have ever foreseen -- we had two different microsoft accounts due to a cofounder buying ONE LICENSE of O365 for excel and doing domain verification because it suggested it.

NewsaHackO2• 4 months ago

It always weird to see how dichotomy of some people saying AI will never be profitable and are doomed to fail and others saying that they are such a essential public service that they are a utility and should be subject to government regulation. Hopefully they are not the same group of people, but I suspect there is a greater overlap that one would expect.

zelphirkalt3• 4 months ago

I have a feeling, that the resolve to do something about it is waning in the EU, because of the plans to soften up the GDPR.

nostrademons2• 4 months ago

It would not surprise me if these actions are coming at the requests of governments. Strong encryption is one of the few things that challenges their monopoly on information; they have a very strong incentive to apply political pressure to the maintainers of these projects to, well, stop maintaining the projects. We've seen this in overt actions that the EU takes; in more covert actions that the U.S. government is suspected of taking; and in the news headlines about third-world dictatorships that just shut off the Internet. Tech companies are perhaps the most convenient leverage point for these actions.

More regulation won't help here, because the regulation-maker is itself the hostile party.

What would help is full control over the supply chain. Hardware that you own, free and open-source operating systems where no single person is the bottleneck to distribution, and free software that again has no single person who is a failure point and no way to control its distribution.

BrenBarn• 4 months ago

They should probably be regulated as utilities and broken up into smaller companies, so that it's easier for people to migrate to alternatives when one company does something bad.

rsync• 4 months ago

You said:

"Currently undergoing some sort of 60 days appeals process, but who knows."

.. and the op said:

"I have tried to contact Microsoft through various channels but I have only received automated replies and bots. I was unable to reach a human."

... which is a roundabout way of saying you did not spend lawyer hours and you did not contact them through channels that they cannot ignore: registered, physical mail, from a lawyer.

I'm sorry for these difficulties, truly, but don't tell me you can't reach a human when you most definitely can reach a human. From my own experience with an organization at least as calloused and indifferent as MS[1], as soon as I sent a real, legal communication I had real live humans lining up to talk to me.

[1] Pacific Gas and Electric

reincarnate0x142• 4 months ago

Microsoft hasn't managed to burn down entire towns (But Copilot is probably working on it), so I suppose we do have at least some kind of gauge of callousness to work off of thanks to PG&E. Which was also the company behind that whole slightly famous Erin Brockovich thing, amongst so very many others.

Sometimes, it's both incompetence AND malice.

zx2c45• 4 months ago

No. The humans just said 60 days.

withinrafael• 4 months ago

Will send some emails.

sellmesoap• 4 months ago

With these big players who are regularly found supporting people with evil intentions: Don't attribute to incompitence what could be ascribed to malice, nay you must trust the gods of the clouds to keep your secrets for you, all for the low low price of $x.99 a month a seat, you may only cancel your service with an arcaine dance and the sacrifice of your first born!

wolrah• 4 months ago

Not exactly the same situation, but RustDesk has recently been removed from the official WinGet community repository because their automated scans have been blocking updates since v1.4.2 in September 2025.

https://github.com/rustdesk/rustdesk/discussions/13025 https://github.com/microsoft/winget-pkgs/pull/345601

tl;dr: ESET Antivirus flags RustDesk as a "Potentially Unsafe Application" because it is a remote administration tool, despite not flagging similar commercial products in the same way, and the WinGet Community repo policy is to block anything flagged as such. Since they were unable to update the repo the RustDesk team requested that the older versions be removed to prevent users from unknowingly installing old versions that could potentially be a security issue in the future. Apparently this has been an issue for a lot of applications especially in the VPN and remote control categories.

There is a discussion about how best to handle these sorts of situations where legitimate and desirable applications get flagged as "potentially unsafe" or "potentially unwanted" but so far it's just been a discussion with no actual changes proposed yet.

https://github.com/microsoft/winget-cli/issues/6107

Nuthen• 4 months ago

Thank you for the extra visibility on this issue. I'm in the exact same boat: account suspended, waiting for the 60 days appeal process. Hopefully it will be resolved swiftly!

SergeAx• 4 months ago

Is there a WireGuard version for Windows above 0.5.3 released in 2021?!

zx2c45• 4 months ago

Hopefully soon, Microsoft-willing.

Avamander2• 4 months ago

I saw a tweet saying that there's a requirement for verification.

Effective October 16, 2025, Microsoft will initiate mandatory account verification for all partners in the Windows Hardware Program who have not completed account verification since April 2024.
Partners who fail to complete Account Verification by the deadline, or who do not meet the requirements, will have their status set to Rejected and will be suspended from the program.

https://x.com/shanselman/status/2041974138253013205

observationist• 4 months ago

/tinfoil time

60 days, long enough for the US to exploit the vulnerabilities discovered by Claude Mythos, short enough to plausibly be bureaucratic corporate awfulness by Microsoft when all is said and done. Basically freezing you and other security software out of protecting the bad guys they particularly want to get at until after the bad guys get got, then everything goes back to normal and Microsoft says "oops, here, we fixed your access."

number201724• 3 months ago

Did you also receive the same support email?

They always just tell me to ask copilot, then they open a case using copilot, and then they tell me to ask copilot again. I said I wanted to prove that the code didn't contain malicious code, and they still told me to ask copilot...

This account has been suspended because the code you submitted contains malware or potential vulnerabilities. If you believe your account was suspended in error and can demonstrate that the code you submitted does not contain malware or vulnerabilities, please follow the below steps, and contact us. . Go here: http://aka.ms/hardwaresupport 2. Click Contact Us 3. Make sure you are signed in with a user associated with the HDC account in Partner Center 4. Select Ask Copilot to receive email support.

janc_5• 3 months ago

How can you _prove_ (“demonstrate”) that your software doesn’t contain malware or any vulnerabilities?

They can’t do that for any of their own software for sure…

GoblinSlayer• 3 months ago

I wonder if npcap can route all traffic through a userland service, then handle it there.

zx2c45• 3 months ago

Microsoft got in touch. All sorted out now.

rogertcb• 3 months ago

After all these statements from M$ claiming they’ve replaced people with AI, wouldn’t be one bit surprised if this “bureaucratic behaviour”, was in fact, some agentic behaviour.

tomgag• 4 months ago

Sorry to hear about this turn of events, but it was pretty much to be expected given the way the world is turning, and Microsoft being Microsoft.

Switch to Linux if you can, and come give Shufflecake a try ;)

https://shufflecake.net/

LWIRVoltage2• 4 months ago

.... This deserves it's own posts , on HN, just for awareness-

Aside from https://web.archive.org/web/20250914062843/https://portswigg... , there haven't been really many goes at going for plausible deniability with modern systems, and I see the segment about a Hidden OS feature in work as well.

Hoping this succeeds. Funny, eventually Shufflecake, after it gets fully capable on Linux, might have to look at making versions for Windows and Mac

8cvor6j844qw_d6• 4 months ago

Seeing this kind of friction makes me more confident in VeraCrypt. The tools that never seem to run into trouble with platform gatekeepers are the ones I'd worry about.

Pay088• 4 months ago

That seems like a very nonsensical stance.

pocksuppet11• 4 months ago

Well look at something like ANOM. The FBI encouraged its use. Because it was run by the FBI and they could see all the private messages.

If Veracrypt was a honeypot, the powers that be would go out of their way to make it as easy to use as possible. They'd instantly sack whoever made this decision, and reverse it.

baobabKoodaa4• 4 months ago

The biggest risk in encryption software is that you lose access to your data. You seem to be ignoring that risk completely and focusing on something else entirely.

dboreham2• 4 months ago

I don't think you would loose access. You can always recover data on an open platform such as Linux.

bilekas2• 4 months ago

And yet another example of companies turning actively hostile against their users.

The burden of usage/access is now solely on the customers and the feeling is that regular customers are just a nuisance to be ignored.

avaer• 4 months ago

Forced software signing should be illegal.

Pay088• 4 months ago

It's not forced, especially for normal software, you just get a popup. It's a bit of a pain to disable the requirement for drivers, though.

baobabKoodaa4• 4 months ago

I don't think you can install VeraCrypt, at least for system encryption, unless the installer is signed

kwar13• 4 months ago

very much sounds like microsoft

Topfi3• 4 months ago

Honest question, did we ever get an answer what was the cause for the sudden change from the original Truecrypt developer?

Even if one doesn't want to maintain that project for purely private reasons, recommending Bitlocker as the drop-in-replacement always made it smell fishy to me.

abcd_f• 4 months ago

It's more or less commonly accepted that its creator got jailed for being an arms dealer.

https://en.wikipedia.org/wiki/Paul_Le_Roux

Topfi3• 4 months ago

I knew the speculation on him being involved in some capacity, but as the wiki page states, this was never confirmed in any substantial way.

More importantly, if development seized with no public comment, that would be one thing and may strengthen the "he got arrested" theory. However, there was some final communication, specific recommendations to rely on Bitlocker of all things, a new version of Truecrypt was released solely for decrypting existing disks and then the web page was removed, including a flag set on robots.txt to ensure it wouldn't appear on archive.org. All this concurrent to a crowd funded source code audit that, in the end, did not find any server issues or backdoors (I recall some speculation back in the day, that either known code quality issues or an intentional backdoor could have caused the exodus).

That all makes it hard to link this to an arrest of the main developer, though I dislike speculation without any hard evidence and if there is no new information, I'll keep this filed under "there is no answer".

diath• 4 months ago

Makes you wonder what kind of leverage/information you have to have to only get 25 years for admitting to being involved in 7 murders.

badocr• 4 months ago

My theory is that Le Roux was just financing the (two?) TrueCrypt developers.

JoshGlazebrook• 4 months ago

He subsequently admitted to arranging or participating in seven murders, carried out as part of an extensive illegal business empire.

Yikes

b65e8bee43c2ed02• 4 months ago

likely chose to shut down rather than bend over, same as Lavabit a year prior. I find it more plausible than the other theory.

Topfi3• 4 months ago

Fair assumption, but unlike Lava, TC never had customer/user data. The NSL/forced shut down theories also make little sense to me however, the fork was up by the end of the week and was easy to foresee. Kinda why this fascinates me so much, no theory I ever read survives basic scrutiny. Perhaps some things, we’ll never know.

jug• 4 months ago

I went on a Wikipedia dive and discovered this funny bit regarding the court process surrounding Lavabit and FBI's desire of the TLS private keys.

The contempt of court was caused by Levison providing the keys printed in a tiny (4 point) font, which was deemed "largely illegible" by an FBI motion, which went on to complain that "To make use of these keys, the FBI would have to manually input all 2560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data."

(And to be clear, that's all they ever saw of said keys)

no_time3• 4 months ago

I would also like to know why is it excluded from Archive.org

https://web.archive.org/web/20260000000000*/https://www.true...

bombcar4• 4 months ago

This can be done by Archive.org doing it for whatever reason (asked, on their own, etc) or it can be triggered by the current owner of the domain modifying robots.txt I believe.

Thorrez• 4 months ago

https://www.truecrypt.org/robots.txt

newsoftheday6• 4 months ago

Agreed, that whole thing was suspicious. I still use TrueCrypt, because of the suspicious nature of how it all went down.

shevy-java2• 4 months ago

This is always a problem when big mega-corporations are involved, be it Google or Microsoft. They want to control the platform.

We really need viable solutions. I have been using Linux since +21 years or so, so it does not affect me personally, but I think Linux needs to become really a LOT more accessible to normal people. And it really has not (on the desktop); all the various "improvements" on GNOME3 or KDE are basically pointless, they have not solved the underlying problem. Ideally problems should be auto-resolvable. If someone wants to use the proprietary nvidia driver, that should be a single click - on ALL Linux distributions. Instead you see some distributions have their own ad-hoc solution and other distributions have no easy solution (for simple people).

SV_BubbleTime5• 4 months ago

I will continue to suppose that the “real issue” with Linux is that the people drawn to developing it will not work well with others and continue year after year to waste time and duplication of effort on five decent, and ten thousand pointless distributions.

Whatever reason for this refusal / inability / choice to not contribute but rather re-create is on the reader to assume.

There is very little effort put into real progress as you point out. Sure, tons of work to move from x11 to Wayland, cool, only the developers give a shit… where is Office/365 that would make daily driving actually viable?

While WINE is impressive, it seems the only real progress for anything past Windows 7 is on paid versions of which there are at least three competing options.

Linux Desktop progress is slow because there it’s thousands of floundering side-projects without a goal of actually pulling normal users in.

teekert4• 4 months ago

I'm sorry, is this some sort of Windows joke that I'm too Linux to understand?

account4224• 3 months ago

Linux isn't inherently safe from the signed boot chain mindset either if you run a mainstream distribution.

no_time3• 4 months ago

prediction: they are testing the waters. If there is enough outcry they will go "oopsie whoopsie, hehe :3 your account is restored".

If there isn't enough outcry they will go forward and disable more signing keys related to things like torrent clients, VPN software, eject UBO from the edge store etc etc.

Atleast now I'm a bit more certain that VC is indeed safe.

superxpro122• 4 months ago

They've finally sprung their enshittification trap. Their move into "open source" was never of friendly origin. It was a business move, plain and simple.

And now they're locking down Window OS, hard. Expect github and vscode to follow.

trinsic210• 4 months ago

I left GitHub for GitLab because i knew this was coming.

hernanhumana• 4 months ago

cool project

0xCE0• 4 months ago

Linux is the only hope at this point for the future of computing.

Windows and macOS are just too risky to do any business with. Waste of all resources.

cguess5• 4 months ago

and yet... still unusable by the mass majority of people.

teekert4• 4 months ago

My kids grew up on Gnome essentially, I can tell you Win11 is a lot more confusing to them, not just because because they grew up on Gnome, there is just so much more ... stuff. And notifications and flashy things and news and weather apps and they all want your attention. Gnome is much more iPadOS like (minus that horrible concoction called the App Store).

Sure, if you're all in on MS365 (like all schools here in the Netherlands), Windows may be somewhat more handy with its native apps and all your stuff there with a single log-in.

tapoxi• 4 months ago

This isn't really true anymore with the advent of Flatpak & Flathub. It's just an app store like any other platform. Even the majority of games work without tweaking.

megous2• 4 months ago

Not used does not mean not usable. Primary school aged children used MS-DOS without any documentation in 1990's. Pretty sure randomly selected people would be able to use modern Linux distro, when pre-installed just like windows are.

WarmWash4• 4 months ago

Linux is stuck because it's made and maintained by people who love linux.

Look at popular unix based OS's - Android, MacOS, iOS..

Whats the first thing they do? Take the command line out back and shoot it. Whereas for linux users, their is this l33t h4cker festishization of only using a keyboard to do everything. All these distros have an extremely robust CLI under the hood, and an afterthought quasi GUI on the surface. Just good enough for grandma to check her email and watch youtube.

uyzstvqs2• 4 months ago

This is always said by people who either never touch the Linux desktop, or exclusively use their own custom Arch setup.

You can install Fedora Linux, Linux Mint or Manjaro, and it's more user friendly than Windows 11 and macOS.

sgbeal• 4 months ago

> Linux is the only hope at this point for the future of computing.

Linux is the most obvious, but there are numerous flavors of BSD as well.

and yet... still unusable by the mass majority of people.

That info is 20+ years out of date. Distros like Suse and Ubuntu made Linux "click, click, click, it's installed" more than two decades ago. i've watched complete non-techies switch to Mint Linux long-term, the only intervention from me (their resident techie) being showing them how to boot up the USB stick installer.

newsoftheday6• 4 months ago

My wife (former Sales Person and Manager) has used Linux for many, many years and prefers it over Windows.

account4224• 3 months ago

Learned helplessness is a problem, yes.

delfinom• 4 months ago

Don't worry, US states are working on making Linux illegal through age verification requirements in the OS.

gruez• 4 months ago

Isn't linux complaint because of the systemd change?

chaostheory2• 4 months ago

Who knows maybe Valve can expand from just gaming?

account4224• 3 months ago

The same Valve that popularized getting kids hooked on gambling while rent-seeking other people's work?

trashface• 4 months ago

Hope this is resolved. I guess I could run linux in a VM and mount volumes there, but this is getting a bit dicey. But Win 10 is my last windows anyway.

folbec• 4 months ago

I would not be surprised if it was some sort of AI driven mistake.

Some guy somewhere deciding to delegate threat assessment to Copilot or some other automated tool.

john_strinlai• 4 months ago

i would bet a years salaray that you are correct. copilot or some automated process. and then the message is automated with an automated appeal-denial flow.

conspiracy theories are fun and all, but 99.99% of the time it is just incompetence, miscommunication, etc.

mapontosevenths3• 4 months ago

Any chance this is the issue?

https://techcommunity.microsoft.com/blog/windows-itpro-blog/...

HumanOstrich3• 4 months ago

From TFA: "I have encountered some challenges but the most serious one is that Microsoft terminated the account I have used for years to sign Windows drivers and the bootloader."

mapontosevenths3• 4 months ago

Yeah, and the first comment beneath that mentions that the most recent version is signed with the "2011 CA" that the article I link to discusses being deprecated.

My guess was that he got caught up in some house-cleaning. My theory being that he's still signing his code the way malware authors also do and got flagged by some automated review that's meant to force him to go get WHCP certified or whatever the new route is.

swordsith• 4 months ago

if michalesoft wants to take away our ability to sign drivers, they will find there is more than enough vulnerable easily exploited drivers we can use that are pre-signed online. Thank you micosawft!

HumanOstrich3• 4 months ago

Are you having a stroke?

c0balt• 4 months ago

Most likely just intentionally misspelling the name in the spirit of calling them Microslop.

qingcharles• 4 months ago

I think it's a reference to Michaelsoft Binbows :)

https://alf-s-room.com/etc/nandarou/binbows/binbows_english....

https://www.youtube.com/watch?v=QRIklga9IBQ

baobabKoodaa4• 4 months ago

Can someone please explain the implications for current Windows users of VeraCrypt?

ratg13• 4 months ago

No new features, no security patches.

baobabKoodaa4• 4 months ago

Anyone here who could reach out to specific persons inside Microsoft who could fix this?

satai• 4 months ago

Microsoft can't be trusted.

Never was, isn't and I guess won't be.

not_a9• 4 months ago

https://community.osr.com/t/locked-out-of-microsoft-partner-... Could be a related issue to this? Maybe Microsoft just doesn’t want driver developers for whatever reason.

superxpro122• 4 months ago

its my computer. its my os. i own it. I paid my money and bought the program. not them. I am free to install whatever software and modify whatever kernel components as i see fit.

I am so sick and tired of the continued erosion of the ownership model. I dont want to rent anything. But corporations see it as an avenue to increase revenue. We pay more, for less. What else is new.

fsflover3• 4 months ago

So why don't you stop using the OS that has a completely different approach to computing?

chaostheory2• 4 months ago

It’s time to switch to Linux or another open OS.

altairprime• 4 months ago

Presumably it’s part of their commitment to kill kernel patching in Windows, to prevent another Worldwide Enterprise Windows Outage Caused By A Buggy Vendor DLL event.

Avamander2• 4 months ago

Most certainly it's related to this: https://techcommunity.microsoft.com/blog/hardware-dev-center...

steve19773• 4 months ago

If only there was a way to sign software and not depend on a centralized authority, something like a... web of trust?

(and yes I know, you'd need to have the option to have "your" (haha...) OS trust it of course)

Hizonner• 4 months ago

This highlights the fact that not only is supporting Windows dangerous to your project, but using Windows is dangerous to your security.

Tsarp2• 4 months ago

For folks looking for a much simpler single binary alternative.

https://github.com/srv1n/kurpod

layer83• 4 months ago

This is not a replacement, as it has no native file system integration, only a web interface.

Tsarp2• 4 months ago

Its not just a web interface. It creates a storage container that can grow and be compacted on the fly is fully portable.

hereme8882• 4 months ago

Besides Veracrypt, are there any real alternatives to Bitlocker for total drive encryption in Windows?

bibimsz• 4 months ago

run Windows as a VM in linux

hereme8882• 3 months ago

lol, creative. bad performance though.

Havoc• 4 months ago

Microsoft continues to push for year of the Linux desktop

unethical_ban2• 4 months ago

I run a dual boot of windows and am currently dauly-driving CachyOS quite happily. I've been playing some Crimson desert and got some occasional crashes... But any other game I have has run smoothly.

Their GUI tools for package management are thin wrappers on CLI tools, but are enough hand-holding that most people should navigate it fine. More devices worked out of the box for my with Linux than Windows.

Just like if you haven't tried AI in a year and have mocked it, you need to try it again. Of you haven't tried Linux desktop in a few years, you need to try again. CachyOS really does seem to handle the driver installs and gaming compatibility well.

raggi• 4 months ago

Cachy pushed a Limine update last weekend without any testing. It broke everyone with secure boot signing. Head proton versions are great, but games tend to turn into a laggy mess after a couple of hours and need regular restarts.

It's decent, but it's not all roses at all, and I wouldn't inflict it on non-techies yet.

unethical_ban2• 3 months ago

Ah, I disabled secure boot assuming it's pointless and wouldn't work with arch and dual booting anyway. Maybe I have more to learn.

Perhaps cachyos should maintain LTS metapackages for more than just the kernel. Video drivers, boot managers and whatnot.

For a "non-gamer" I would probably keep them on Fedora or even Debian.

cynicalsecurity• 4 months ago

If you use Veracrypt on Windows then you have no idea what you are doing. Windows is not safe. Use Linux only.

HackerThemAll3• 4 months ago

I would love to switch long time ago, but I make money on Windows enterprise customers, using specific Windows tools that have no reasonable Linux counterparts.

I'll throw my Windows laptop out of a (pun intended) window on the exact second I'll secure viable and sustainable income using Linux. I know it can be done, but so far it's outside of my circles.

Izmaki2• 4 months ago

Reminds me of when users of TrueCrypt were urged to just install BitLocker instead. Sus AF.

LWIRVoltage2• 4 months ago

What sucks about this, is due to implementation,Windows is the only way to achieve some stuff in Veracrypt. For example: doing full system partition encryption, and the Hidden OS install that only Veracrypt can do- requires Windows with the computer set to MBR rather than UEFU. I had hoped we'd see more of the plausible deniability tech at the OS level

But aside from one or two experimental attempts, also presented at BlackHat https://web.archive.org/web/20250914062843/https://portswigg...

- the consumer has nearly lost access to high end plausible deniability

Tepix• 4 months ago

Windows is the only way to achieve some stuff in Veracrypt

On the other hand, if you get rid of Windows you don't even need Veracrypt.

newsoftheday6• 4 months ago

First I was surprised to read the Veracrypt maintainers could be in this situation, then read the top comment where Wireguard maintainers are too (unless I misunderstood). Is this some malicious new program inside Microsoft to try and shutdown open source projects so they can push Windows products and solutions more?

gzread6• 4 months ago

Yes.

NewsaHackO2• 4 months ago

It feels more like an automated block due to uncharacteristical increase in download activity. Something that it seems more and more companies are taking seriously is the cottage industry of scams involving less technically savvy downloading apps online and getting their information stolen. The motivation for this is probably the same as Google stopping side loading. Take that as you want.

subscribed4• 4 months ago

And how would blocking the devs ability to sign the new version stop the spread of the already downloaded and still available old version?

I think you forgot we're talking about the kernel drivers specifically - normal scammers don't need that, they use AnyConnect downloaded from Chrome.

I think you also forgot to read it all and missed that it was supposedly some deanonymisation (ID verification) process that kicked it off, and missed that the dev has immediately verified themselves but then we're told they need to wait 2 months to wait.

Because.

It's not an automated process at this point.

lofaszvanitt• 4 months ago

What about the guy who originally created it. Paul Le Roux, the criminal mastermind? That's a wild story :D.

pjdesno• 4 months ago

Interesting.

My only experience with Veracrypt is via a law firm I was consulting with, who used it to protect some files they were sharing with me. Law firm and their end client are both big, prestigious companies.

idolofdust• 4 months ago

Get off Windows right now.

The newest frontier AI models can easily find 0-days in all major software stacks, while the two biggest open source security tools on Windows can’t even ship patches.

1970-01-01• 4 months ago

Why is there no simple workaround for this? Why is it dead in the water and why can't we use another mechanism to verify the update files with SHA1? It's all been done before [1]. This would be an improvement, as it enables the project to continue working without any handcuffed relationship to Microsoft.

[1] https://github.com/HyperSine/Windows10-CustomKernelSigners

Ms-J• 4 months ago

Posted this earlier from a throwaway since my account wasn't able to reply for some odd reason and it was marked as dead:

Hello Jason!

I want to first thank you for all of your hard work developing Wireguard.

If I can find someone who is willing to put their name on it to help I definitely will, the problem is the spy agencies don't want your project to exist. It makes it harder to put resources to this. I've worked in security departments of certain companies and saw everything you could imagine.

Same for Mounir over at Veracrypt.

Both of you are developing some of the most important software that exists today.

Keep doing what you are doing by keeping everything in the open. User trust almost doesn't exist for these type of projects. Any hint of an issue would wipe that out in seconds.

This leads me to one question I do have for you zx2c4:

Why does Wireguard attempt to contact your servers and auto update on Android with no toggle to turn this off? It's a threat to everyone. Maybe it also does this on other platforms but I haven't tested them all.

I can think of reasons as to why you did this, none nefarious, but still it would be nice if you included that option so I don't have to patch each update to turn this off.

Thanks.

ChrisArchitect• 4 months ago

Update from Scott Hanselman:

Hey I love dumping on my company as much as the next guy, because Microsoft does some dumb stuff, but sometimes it's just check emails and verify your accounts.

Not every "WTF micro$oft" moment is a slam dunk. I've emailed VeraCrypt personally and we'll get him unblocked. I've already talked to Jason at WireGuard.

Not everything is a conspiracy, sometimes it's literally paperwork.

(https://x.com/shanselman/status/2041977121686585396 https://xcancel.com/shanselman/status/2041977121686585396)

francosimon2• 4 months ago

VLayer (my project) scans healthcare codebases for HIPAA compliance issues before they reach production. One thing I learned building it: developers rarely think about encryption until it's too late. Tools like VeraCrypt solve the "data at rest" problem, but the bigger issue in healthcare software is unencrypted data in logs and API responses — stuff that's much harder to audit manually.

feyman_r• 4 months ago

Update from a VP at Microsoft: https://x.com/shanselman/status/2041977121686585396?s=46

bilekas2• 3 months ago

Amazing that their processes failed and didn't work, so the VP lashes out at everyone calling them out for it. It's not like Microslop isn't a huge organization that is the critical component here. Extremely unprofessional response, I'll reiterate, they see regular users as a nuisance.

j16sdiz• 3 months ago

I guess the real problem is, everybody's inbox is overwhelmed with useless junk.

Expect someone read and follow instructions in email are not that realistic anymore

likiiio• 3 months ago

So, he's upset at users for getting fucked over by his company? Intresting fellow.

account4224• 3 months ago

Sounds like someone who should be barred from speaking publicly for the company.

orionblastar• 4 months ago

Gone are the days when one can be anonymous on the Internet. Now, in some places, we have to prove our age and identity. This is leading to a digital ID. This will end badly.

totetsu• 3 months ago

looks like the latest update was

Mounir IDRASSI - 7 hours ago Thank you all for your feedback and your support in getting media attention through various social platforms.
After posting this, other developers in the security fields (like WireGuard) came forward to announce that they have the exact same issue. I understand why nobody talked publicly about this before and I'm glad that by going public I pushed others to do the same.
Positive aspect is that a Microsoft VP (Scott Hanselman) has announced on X that he will help address this issue affecting me and others. He also reached out to me and connected me with other Microsoft people to help address this issue.
I will let you know how things go.

ece• 3 months ago

If bitlocker wasn't crippled[1] on the home versions of Windows, this would be a non-issue. I hope a solution is found, even if it's 3rd party signing that works like the present solution.

[1] https://www.microsoft.com/en-us/windows/compare-windows-11-h...

Microsoft terminated the account VeraCrypt used to sign Windows drivers

Related Stories