WireGuard, a major software project and VPN behind popular security software such as Mullvad, discovered that key parts of its Microsoft developer accounts were locked out, preventing it from providing software updates to Windows users.
Jason Donenfeld, the creator of the open source WireGuard VPN software, told TechCrunch that his Microsoft developer account has been locked out and as a result he cannot sign or provide updates to drivers for WireGuard for Windows users that are critical to running the software. Donenfeld said in a post from X on Wednesday that WireGuard update shipments were halted due to the account termination.
This is the second time a popular and popular open source project has been blocked from customers due to Microsoft’s sudden account termination, with popular encryption software VeraCrypt also facing a similar situation. Both developers said Microsoft locked their accounts without warning them first.
For VeraCrypt, which hundreds of thousands of users use to encrypt their files and operating systems, developer Mounir Idrassi told TechCrunch that being locked out of one’s account means the software cannot be updated in time for important certificate authority expirations, which could prevent some users from booting.
“If there were a critical vulnerability that needed to be fixed right now, it doesn’t exist! Hypothetically speaking, users would be completely exposed,” WireGuard developer Donenfeld told TechCrunch via email.
WireGuard is an open source VPN software used around the world to connect devices over the Internet. WireGuard’s code is very popular for its simplicity and security, as it serves as the foundation for many VPN implementations and commercial services that rely on it, such as Proton and Tailscale.
Donenfeld told TechCrunch via email that he’s been modernizing WireGuard’s Windows code over the past few weeks and is ready to send a copy of the update to Microsoft for verification before it’s available to users, but he’s been getting a “restricted access” error when logging into the developer portion of his Microsoft account.
Even though Microsoft went through the process of verifying his driver’s license or passport (the third party Microsoft uses for verification said he was “verified”), Donenfeld said his access was still suspended.
Donenfeld told TechCrunch that he found a page on Microsoft’s website that said the company had performed “required account verification for all partners in the Windows hardware program who have not completed account verification after April 2024,” but that the verification program has ended.
Microsoft’s Windows Hardware Program allows developers like Donenfeld and VeraCrypt’s Idrassi to “distribute hardware and device drivers for Windows PCs and other devices.” Our ability to develop and release drivers for Windows users is limited to known and proven developers. This is because drivers can give extensive access to the operating system and its data and are known to be exploited by hackers for this reason.
This account verification process meant that developers had to upload government-issued IDs before they were allowed to publish potentially highly sensitive code to the broader Windows user base.
“Microsoft has not notified me about this at all. I’ve looked in all my mail logs, all my spam folders, all my inboxes, and there’s nothing,” Donenfeld said.
The Verifier for Windows Hardware program is “now closed” and the accounts of developers who have not uploaded documentation have been “suspended.” According to the page, the account can no longer send updates.
Donenfeld was referred to Microsoft’s executive support team, which handles customer service and account requests for celebrities, and confirmed his appeal had been received, but said he would have to wait up to 60 days for a review.
As of late Wednesday, there was a glimmer of hope in Donenfeld’s case. He told TechCrunch that he has finally made contact with Microsoft and hopes the issue will be resolved soon.
Microsoft did not immediately comment when contacted by TechCrunch.
Donenfeld and Idrassi are not alone, their account lockout issues affect others as well.
Windscribe, a maker of VPNs and other consumer privacy tools, said in X’s post that its Partner Center account had also been locked. The company said it has verified accounts for over eight years to sign drivers.
“We’ve been trying to resolve this issue for over a month with no results. Support is non-existent,” Windscribe said in a post. “Does anyone know of a human being who still works at Microsoft and has a brain that can help?”
