WireGuard, the major software project and VPN that underpins popular security software including Mullvad and others, has found itself locked out of a key part of its Microsoft developer\u2019s account and unable to ship software updates to Windows users.<\/p>\n
Jason Donenfeld, the creator of the open source WireGuard VPN software, told TechCrunch that he has been locked out of his Microsoft developer account, and as a result cannot sign drivers or ship updates for WireGuard for Windows users, which are critical for its software to run. Donenfeld said in a post on X<\/a> on Wednesday that the account termination stopped a WireGuard update from shipping.<\/p>\n It\u2019s the second such incident<\/a> of a high-profile and widely used open source project being shut out from its customers due to a seemingly abrupt account termination from Microsoft, with popular encryption software VeraCrypt facing a similar circumstance. Both developers said Microsoft locked them out of their accounts without first alerting them.\u00a0<\/p>\n In the case of VeraCrypt, which is used by hundreds of thousands of users to encrypt files and operating systems, its developer Mounir Idrassi told TechCrunch<\/a> that being locked out of his account means he is unable to update the software in time for a crucial certificate authority expiry, which he said may prevent some users from booting up.<\/p>\n Donenfeld, the WireGuard developer, told TechCrunch in an email: \u201cIf there were a critical vulnerability to fix right now \u2014 there isn\u2019t! I just mean hypothetically \u2014 then users would be totally exposed.\u201d<\/p>\n WireGuard is an open source VPN software used around the world to connect devices over the internet. WireGuard\u2019s code is highly popular for its simplicity and security, as it serves as the foundation of many VPN implementations and commercial services that rely on its code, like Proton and Tailscale.<\/p>\n Donenfeld told TechCrunch in an email that he has spent the past few weeks modernizing WireGuard\u2019s Windows code and was ready to send a copy update to Microsoft for checks before it can ship out to users, but was met with an \u201caccess restricted\u201d error when logging into the developer portion of his Microsoft account.<\/p>\n Despite going through the process to verify his driver\u2019s license or passport with Microsoft (the third party Microsoft uses for verification said he was \u201cverified\u201d), Donenfeld said his access was still suspended.<\/p>\n Donenfeld told TechCrunch that he found a page on Microsoft\u2019s website<\/a> saying that the company had been carrying out \u201cmandatory account verification for all partners in the Windows Hardware Program who have not completed account verification since April 2024,\u201d but that the verification program had since closed.<\/p>\n Microsoft\u2019s Windows Hardware Program allows developers like Donenfeld and VeraCrypt\u2019s Idrassi to \u201cdeploy hardware and device drivers for Windows PCs and other devices.\u201d The ability to develop and release drivers for Windows users is restricted to known and vetted developers, as drivers can grant vast access to an operating system and its data and are known to be abused by hackers<\/a> for that reason.<\/p>\n That account verification process meant that developers were required to upload their government-issued ID before they were allowed to publish potentially highly sensitive code to the broader Windows user base.<\/p>\n \u201cMicrosoft never sent me any notification at all about this. I\u2019ve looked in every inbox in every spam folder in every mail log, and zero, nothing, zilch,\u201d Donenfeld said.<\/p>\n The Windows Hardware Program\u2019s verification program has \u201cnow concluded\u201d and developers who have not uploaded their documents had their accounts \u201csuspended,\u201d the page reads, meaning that these accounts can no longer send updates.<\/p>\n Donenfeld said that he was referred to Microsoft\u2019s executive support team, which handles customer service and account requests for high-profile individuals, which confirmed his appeal had been received but that they had to wait as long as 60 days for review.<\/p>\n By late Wednesday, there was a glimmer of hope in Donenfeld\u2019s case. He told TechCrunch that he was finally in contact with Microsoft and that hopefully the issue would be resolved soon.<\/p>\n Microsoft did not immediately comment when reached by TechCrunch.<\/p>\n Donenfeld and Idrassi are not alone, with the account lockout issues affecting others as well.<\/p>\n