Microsoft terminates VeraCrypt account, halting Windows updates

https://www.404media.co/microsoft-abruptly-terminates-veracrypt-account-halting-windows-updates/

by donohoe • 4 months ago

594 243 4 months ago

404media.co

https://archive.ph/Oc85c

msla• 4 months ago

With Windows, you get what you pay for.

In this case, that's an OS controlled by an unaccountable company that can take application software away from you.

Related: If you're the customer, you're the product.

Already__Taken• 4 months ago

Windows actually isn't very cheap.

stronglikedan• 4 months ago

agree, because "free" can be neither "cheap" nor "expensive"

dark-star5• 4 months ago

you can always either disable secureboot and driver signature verification, or (the better solution) just enroll your own certificate in your TPM and sign the driver with that...

malfist• 4 months ago

or (the better solution) just enroll your own certificate in your TPM and sign the driver with that...

I'll tell Grandma that's what she needs to do.

askonomm2• 4 months ago

Ah, yes, the [insert super inconvenient and complex thing to do that most people don’t know, want or should do] will solve it! And when that fails, surely the user can just write their own OS, right? Bunch of skill-issued complainers we the users are.

ntoskrnl_exe• 4 months ago

And they say Linux is inconvenient because you have to open the terminal every once in a while.

subscribed• 4 months ago

Hmmm, so basically Google but you also pay for it?

kgwxd• 4 months ago

ChromeOS and Android are definitely comparable.

panzi• 4 months ago

I see what you did there.

nubinetwork• 4 months ago

https://news.ycombinator.com/item?id=47686549

Tempest1981• 4 months ago

Thanks, the previous title was easy to miss: "Veracrypt project update"

account4215• 3 months ago

HN's guidelines for submission titles can be really counterproductive sometimes.

Lihh27• 4 months ago

heh the same company that controls your secure boot chain just killed the signing account for the tool that encrypts your disk

ai5iq• 4 months ago

This is the same pattern playing out everywhere. The platform giveth, the platform taketh away. If your software's distribution depends on one company's good graces, you don't really ship it they do

salawat• 3 months ago

But nooooooo. All of us screaming bloody murder about UEFI Secure Boot impl's and code signing, and how they were the fundamental primitives to locking users out of general computation were the "paranoid" ones.

The entire Trusted Computing initiative had exactly one benefactor, and it was people looking to constrain what you did on your own machine. Y'all just set up your "End-of-Analysis" goalposts too early, and blinded yourselves to the maliciousness bundled in silver tongued beneficent intentions.

We'd be better off as a society all recognizing the inherent risk of computation than lulling people into a habit of "trust us bro" espoused by platform providers. Anyone trying to sell Trust is someone you can't afford to be trusting of.

I'll live with the threat of rootkits if it means no one can pull this kind of shit.

ChrisArchitect• 4 months ago

[dupe] https://news.ycombinator.com/item?id=47686549

20k• 4 months ago

There's a good reason everyone calls them microslop these days. The sooner we're all able to ditch this crappy company, the better - they're actively holding back the tech industry at this point

tonyedgecombe• 4 months ago

They have been holding back the tech industry for decades now.

embedding-shape• 4 months ago

To be fair, the tech industry been holding itself back for decades now too, since lots of people seemingly have somewhat low prices to go from being a FOSS evangelist to wearing a "Microsoft <3 Open Source" t-shirt.

BigTTYGothGF• 4 months ago

Looking at the rest of the tech industry in 2026 that might be a blessing.

p_ing5• 4 months ago

What does this even mean? It's like throwing around the word 'bloat'.

trueno2• 4 months ago

i remember years and years ago learning some posix/shell syntax and working in terminal. felt like my love for windows unraveled in real time. these days using windows... feel like i gotta take a shower after. like many i was just raised on windows it was the household operating system i had like 20 years of general computer usage under my belt on windows before i finally felt a mac trackpad for the first time. that hardware experience alone was the first pillar kicked out upholding my "windows is the best" philosophies. then i got into coding, then i tripped and fell out of hourly boeing slave labor into a sql job (lost 55% yearly income, no regrets yo). then i started discovering the open source world, and learned just how much computing goes on outside of the world of windows and how many insanely bright minds are out there contributing to... not microsoft. now i have linux and macos machines everywhere, i still haven't found the bottom but the last 6-7 years or so have been a really rich journey.

currently have a 32bit win xp env spun up in 86box just to compile a project in some omega old visual studio dotnet 7 and the service pack update at the time (don't ask). it is seriously _wild_ being in there, feels like stepping into a time machine. nostalgia aside, the OS is for the most part... quiet. doesn't bother you, everything is kind of exactly where you expect it to be, no noise in my start menu, there isnt some omega bing network callstack in my explorer, no prompts to o365 my life up.

it feels kinda sad, what an era that was. it's just more annoying to do any meaningful work in windows these days.

im currently working with c/cpp the idiot way (nothing about my story is ever conventional sigh), by picking a legacy project from like 22 years ago. this has forced me to step back into old redhat 7.1+icc5, old windows xp + dotnet7 like i explained above, and im definitely taking the most unpragmatic approach ever diving in here.. but there's one thing that absolutely sticks out to me: microsoft has always tried to capitalize on everything. tool? money. vendor lock. os? money. vendor lock. entire industries/education system capture? lotta money. lotta vendor lock. lotta generational knowledge lock.

they are lucky people are still using github. theyve tried to poke the bear a few times and theyre slowly but surely enshittifying the place, but im just kinda losing any reverence for microsoft altogether. microsoft has been big for a hot minute now, they have their eras. you can feel when things are driven by smart visionary engineers working behind the scenes, and you can tell when things are in pure slop mode microservice get rich or die trying mode. yea, microsoft has.. always been vendor-lock aggro and kinda hostile, but the current era microsoft is by far the grossest it's ever been. see: microsoft teams (inb4 "i use teams every day, i dont have a problem with it")

im aware people smarter than me can write diatribes on why windows is the best at x thing, but im only informed by my own experience of having to use all three (linux/macos/windows) for my professional work life: i grew up thinking windows was the best.. now im like mostly confident that windows is actually the worst lol. by a pretty damn decent margin. i was gaslit for ages

philistine2• 4 months ago

feel like i gotta take a shower after

I run Crossover and I feel like I gotta take a shower after. Just knowing there's a folder called drive_c on my Mac is the stuff of nightmares.

shevy-java2• 4 months ago

Yeah. I felt in a similar manner when I moved to Linux. Microsoft seemed to make people dumber. I do actually use both Linux and Windows (Win10 only), largely for testing various things, including java-related software. But every time I use Windows, I am annoyed at how slow everything is compared to Linux. (I should mention that I compile almost everything from source on Linux, so most of the default Linux stack I don't use; many linux distributions also suck by default, so I have to uncripple the software stack. I also use versioned appdirs similar as to how GoboLinux does, but in a more free form.)

mbix77• 4 months ago

Yea, I'm in the process of converting our complete ETL infrastructure from SSIS/SQL Server to Python/PostgreSQL. Next step is Office 365, which will be more difficult, but doable since we are a small company anyway.

stvltvs• 4 months ago

Are you converting the SSIS automatically somehow or rewriting it?

aetherspawn• 3 months ago

Apple suite (Pages, Numbers etc) works well, has good mobility to mobile, and is free.

Apple Mail and Apple Calendar are fine to replace Exchange, as is Thunderbird(see 1), but Mail is more turnkey (1-click pairs with MS Exchange)

You can downgrade your O365 licenses to Exchange Plan 1 and keep your email hosting at a tiny fraction of the price of full 365 suite.

(1): Beware thunderbird has an open and unsolved bug that randomly deletes all your emails, kind of like a 1d1 million dice roll.

giancarlostoro• 4 months ago

Outside of work, I don't use Windows very often if at all. I have a 2017 laptop that Microsoft made, and it is so damn sluggish for absolutely no reason, its VERY VERY vanilla mind you.

leptons2• 4 months ago

Apple also holds back the tech industry in many ways. All companies seem willing to put profits before progress.

red-iron-pine2• 4 months ago

active directory and excel runs the world.

what is apple doing that is similar?

romaniv2• 4 months ago

I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.

astrobe_4• 4 months ago

I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.

2019844• 4 months ago

And what if that customer wants to run their own firmware, ie after the manufacturer goes out of business? "Security" in this case conveniently prevente that.

tosti3• 4 months ago

Computers should abide by their owners. Any computer not doing that is broken.

mort963• 4 months ago

It's to serve the regulators. The Radio Equipment Directive essentially requires the use of secure boot fir new devices.

Galanwe2• 4 months ago

id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with

The firmware of the device being a binary blob for the most part... Not like I trust it to begin with.

Whereas my open source Linux distribution requires me to disables SecureBoot.

What a world.

PunchyHamster2• 4 months ago

well, unless govt tells MS to tamper it

burstmode• 4 months ago

I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the PRODUCER; id est provide guarantees to the PRODUCER that the firmware of the device they SELL has not been tampered with at some point in the PROFIT chain.

pjmlp• 4 months ago

If only people didn't install Ask Jeeves toolbars all over the place and then asked their grandson during vacations to clean their computer.

prerok• 4 months ago

Geez, this brings back memories.

At one time at our university we had table desktop dancers installed everywhere. Was kind of funny when it turned up just as a student wanted to defend their work in a lab.

account4215• 3 months ago

Hey I made some good money from that as a kid. And some of the malware that people ended up with was also fairly visually pleasing to a teenager.

asveikau• 4 months ago

Apple is also somewhat responsible for the attitude shift with the introduction of iOS. 20-25 years ago a locked down bootloader and only permitting signed code would have been seen by techies as dystopian. It's now quite normalized. They say it's about security but it's always been about control.

Stallman tried to warn us with "tivoization".

arcfour8• 4 months ago

I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish.

Does that mean that Microsoft doesn't also use it as a form of control? Of course not. But conflating "Secure Boot can be used for platform control" with "Secure Boot provides no security" is a non-sequitur.

kelseyfrog2• 4 months ago

Anything that restricts user freedom is entirely bad, even if it's at the expense of security.

serf• 4 months ago

It's necessary for FDE to have any sort of practical security

why? do you mean because evil maid attacks exist? anyone that cared enough about that specific vector just put their bootloader on a removable media. FDE wasn't somehow enabled by secure boot.

bootkits are a security nightmare and would otherwise be much more common in malware

why weren't they more common before?

serious question. Back in the 90s viruses were huge business, BIOS was about as unprotected as it would ever possibly be, and lots of chips came with extra unused memory. We still barely ever saw those kind of malware.

whatevaa• 4 months ago

Full disk encryption protects from somebody yanking a hard drive from running server (actually happens) or stealing a laptop. Calling it useless because it doesn't match your threat model... I hate todays security people, can't threat model for shit.

fsflover3• 4 months ago

Instead of proprietary SecureBoot controlled by megacorps, you can use TPM with Heads based entirely on FLOSS with a hardware key like Librem Key. Works for me and protects from the Evil Maid attack.

jrm44• 4 months ago

Secure Boot provides no useful security for an individual user on the machine they own, and as such should be disabled by default.

If you want to enable it for enterprise/business situations, thats fine, but one should be clear about that. Otherwise you get the exact Microsoft situation you mentioned and also no one knows about it.

gusfoo• 4 months ago

I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security

For home/business users I'd agree. But in Embedded / money-handling then it's a life-saver and a really important technology.

TitaRusell• 4 months ago

Videogames are increasingly demanding secure boot.

account4215• 3 months ago

If by "really important technology" you mean it lets companies save a bit on fraud-related expenses then sure. But the world worked just fine with much simpler solutions because secure boot or not we have plenty of ways to discourage most people from committing crimes.

duped3• 4 months ago

This is like saying you shouldn't vaccinate your kids because no one gets polio anymore

account4215• 3 months ago

We we don't just pump our kids with any vaccine ever developed "just in case" either. Instead we weight actual risk against possible side effects - a concept most security people seem to be unable to grasp.

gloosx• 3 months ago

Executable signing is also designed to make easy money from selling certificates

onehair2• 4 months ago

They should have also picked up that WireGuard Creator account also got his account terminated

tsujamin2• 4 months ago

They did, just further into the article:

According to a post on Hacker News, the popular VPN client WireGuard is facing the same issue.

onehair2• 4 months ago

I meant to say, in the title. As Wireguard is way more popular than VeraCrypt...

shevy-java2• 4 months ago

Microsoft wants to control computers. This is why they came up with InsecureBoot - or ad-hoc eliminating accounts willy-nilly style. Microsoft kind of acts like Google here. It is also interesting that the US government is doing absolutely nothing against this despicable behaviour.

red-iron-pine2• 4 months ago

the US government is owned by corporate interests and has been in some capacity since inception. special mention to the Russians and Israelis and Saudis who also own a piece.

dns_snek5• 4 months ago

This is precisely why we can't allow platform-owners to be the arbiters of what software is allowed to run on our devices. Any software signing that is deemed to be crucial for ensuring grandma-safety needs to be delegated to independent third parties without perverse incentives.

This is what the Digital Markets Act is supposed to protect developers against. Have there been any news regarding EU's investigation into Apple? Last I remember they were still reviewing their signing & fee-collection scheme.

duped3• 4 months ago

There is nothing stopping you from using third party certificates to sign Windows binaries. It's just expensive. You don't even need a MS toolchain or CLI tool for it.

dns_snek5• 4 months ago

“Users who have enabled system encryption with VeraCrypt may face boot issues after July 2026 because Microsoft will revoke the [certificate authority] that was used to sign the VeraCrypt bootloader,” Idrassi said. “A new Microsoft CA must be used for bootloaders to continue working.”
Without access to the Microsoft account used for sending software updates, “I will not be able to apply the required new signature to VeraCrypt, making it impossible to boot.”

Capricorn24812• 4 months ago

It's just expensive

So yes there is.

VadimPR3• 4 months ago

A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform.

A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially since there no human support available at all, for a product I was willing to pay and use!

We ended up getting our certificate sourced from https://signpath.org and have been grateful to them ever since.

tsujamin2• 4 months ago

For what it’s worth, Trusted Signing verification has been a moving target over the last 12 months. It was open for individuals, then it was closed to anyone except (iirc) US businesses with DUNS numbers, then it opened again to US based individuals (and a few other countries perhaps).

My completely uninformed guess was that someone had done something naughty with Trusted Signing-issued code signing certificates.

Anyway, when I first saw the VeraCrypt thing this morning my initial reaction was “I wonder if this is them pushing developers onto trusted signing the hard way?”

VadimPR3• 4 months ago

I'm in Europe and ended up creating an organization since I have my own company, but they messed up the verification of one of the legitimate documents, and there was no way to reach them once they made that mistake. Frustrating, and definitely a lost customer for them.

michaelt• 4 months ago

I don't know anything about Trusted Signing verification, but I do know from reports on 'mini umbrella company fraud' that if you're a fraudster, there are people in the Philippines who will happily sign their name to western countries' official paperwork in exchange for $2000 or so. Understandably, as that's more than the country's median annual income.

So I can see why offering trusted signing for individuals worldwide would come with certain challenges.

dolmen• 3 months ago

Anyway, when I first saw the VeraCrypt thing this morning my initial reaction was “I wonder if Iran uses VeraCrypt”

riedel2• 4 months ago

I like the idea of a central signing authority for open source. While this might go against the spirit of open source, I think it eventually creates a critical mass and outcry if Microsoft or Google would play games with them. Also foundations might be a good way to protect against legal trouble distributing OSS under different regulations. I am imagining e.g. an FDroid that plays Googles game. With reproducible or at least audited builds also some trusted authorities could actually produce more trusted builds especially at times of supply chain attacks. However, I think such distribution authorities would need really good governance and a lot of funding.

VadimPR3• 4 months ago

If someone is willing to put in the work in governance, FOSS projects would be willing to fund it - at least Mudlet would be. We get income from Patreon to cover the costs.

AnthonyMouse9• 4 months ago

There is no real advantage of a central signing authority. If you use Debian the packages are signed by Debian, if you use Arch they're signed by Arch, etc. And then if one of them gets compromised, the scope of compromise is correspondingly limited.

You also have the verification happening in the right place. The person who maintains the Arch curl package knows where they got it and what changes they made to it. Some central signing authority knows what, that the Arch guy sent them some code they don't have the resources to audit? But then you have two different ways to get pwned, because you get signed malicious code if a compromised maintainer sends it to the central authority be signed or if the central authority gets compromised and signs whatever they want.

fl0id• 4 months ago

isn't the issue more that this also needs to be included by default in Windows?

M95D2• 3 months ago

I like the idea of a central signing authority for open source.

It would be the most corrupt(ible) org ever involved in open source and it would promote locked-down computing, as that would be their main reason to exist. Be careful what you wish for!

account4215• 3 months ago

It's absurd that anyone should pay Microsoft or their goons anything to provide free software for their platform. Code signing is a scam.

fuckinpuppers2• 3 months ago

Azure is garbage at all levels

avipars• 4 months ago

https://archive.md/Oc85c

saltamimi2• 4 months ago

I'm confused why they can't just generate their own signing key and deploy it alongside the installer.

Using arbiter platforms like this sounds like a great way to footgun yourself.

Someone1234• 4 months ago

Because a bad guy can also generate their own signing key and deploy it alongside the installer.

See Notepad++ for how that winds up.

saltamimi2• 4 months ago

Then you can publish the public Code Signing certificate for download/import or publish it through WinGet.

Using Azure Trusted Signing or any other certificate vendor does not guarantee that a binary is 100% trustworthy, it just means someone put their name on it.

billziss• 4 months ago

It is not just VeraCrypt that has been affected by this. There is a bunch of Windows driver developers that have been suddenly kicked out of the "Partner Center" without explanation.

https://community.osr.com/t/locked-out-of-microsoft-partner-...

valeriozen• 4 months ago

We are seeing the dark side of "Security as a Service". When Microsoft simplifies the signing pipeline (like with Trusted Signing), they also centralize the point of failure. The fact that a FOSS pillar like VeraCrypt can be sidelined due to what looks like an automated account flagging issue with no path to human arbitration shows that the current system is too fragile for critical infrastructure. Secure Boot is a great security feature, but it shouldnt be used as a tool for vendor lock in through administrative incompetence

Jigsy• 4 months ago

Windscribe is now the third one to be terminated by Microsoft as well...

https://nitter.net/windscribecom/status/2041929519628443943

number201724• 3 months ago

5eplay.com has also been suspended, as well as my company.

blindriver• 4 months ago

It's okay. I'm pretty sure after 40+ years of using Microsoft products I'm going to switch fully to Linux and MacOS. I'm tired of fighting against Microsoft even though I am a long time (and mostly happy) user of Windows. But whatever is going on in the last few years, especially Recall, has made it dangerous in my opinion to keeping Windows. So as they become and more draconian it only makes my decision easier and easier. I've had Macs and Macbooks for a while now but I bought the latest Macbook Pro and I'm very very happy with it, despite Glass (I barely notice any differences from the previous version).

MetroWind• 3 months ago

Apple has trained people to believe their software needs to be signed by someone they don't know or trust.

fuckinpuppers2• 3 months ago

Hopefully this is just boot issues, and not VC in general moving forward for now. I just centralized on leveraging VC for container encryption. I actually moved away from VC back to Bitlocker for FDE just a couple weeks ago (I forget the exact reasons why)

But I still like it for containers, and I hope they can figure out a way to get it fixed for VC and WireGuard or they can figure out alternate signing options and a migration path.

Microsoft terminates VeraCrypt account, halting Windows updates

Related Stories