WireGuard and other developers locked out of Microsoft accounts

Several high-profile open source projects have been locked out of their Microsoft developer accounts without prior notification. The account lockouts affect WireGuard, VeraCrypt, and Windscribe, preventing these developers from shipping critical software updates to Windows users. Jason Donenfeld, the creator of the open source WireGuard VPN software, posted on X on Wednesday that an abrupt account termination has stopped a WireGuard update from shipping. WireGuard is an open source VPN software used around the world to connect devices over the internet. Similarly, VeraCrypt is seemingly facing a similar account termination circumstance. Windscribe, a maker of VPN and consumer privacy tools, has also been locked out of its Partner Center (Microsoft’s developer portal) account.

The lockouts stem from a mandatory verification program for the Windows Hardware Program (Microsoft’s program for deploying hardware and device drivers for Windows PCs and other devices). Microsoft’s portal states that the verification program has “now concluded” and accounts that did not complete verification have been suspended. This program concluded in April 2024, but developers report they received no prior warning. The verification process requires developers to upload government-issued ID before publishing code to Windows users. Donenfeld went through the process to verify his driver’s license or passport, and although the third-party verifier marked him as “verified,” his access remained suspended. Windscribe, which had a verified account for eight years to sign its drivers, was locked out and told it must wait. Donenfeld was referred to Microsoft’s executive support team, which confirmed his appeal was received but noted he had to wait 60 days for review.

The inability to ship updates has raised security concerns. VeraCrypt, which is used by hundreds of thousands of users to encrypt files and operating systems, cannot update its software in time for a certificate authority expiry, which may prevent some users from booting up. Donenfeld discovered the “access restricted” error when trying to log in to submit WireGuard’s Windows code. He warned of the potential risks: “If there were a critical vulnerability to fix right now — there isn’t! I just mean hypothetically — then users would be totally exposed.” Meanwhile, Windscribe described Microsoft’s support as “non-existent” after trying to resolve the issue for over a month.

Why it matters

The lockout of high-profile open source projects from Microsoft’s developer portal prevents developers from shipping critical software updates to Windows users, potentially leaving them exposed to vulnerabilities.