WireGuard, a prominent software project and VPN that forms the backbone of many security applications including Mullvad and others, has encountered a blockade in a significant segment of its Microsoft developer account, rendering it unable to release software updates to Windows users.
Jason Donenfeld, the inventor of the open source WireGuard VPN software, informed TechCrunch that he has been barred from accessing his Microsoft developer account, consequently hindering his ability to sign drivers or send updates for WireGuard to Windows users, which are essential for its operation. Donenfeld mentioned in a post on X on Wednesday that the account termination has prevented a WireGuard update from being released.
This marks the second occurrence of a prominent and widely utilized open source project being denied access to its users due to what appears to be an abrupt account termination by Microsoft, with the well-known encryption tool VeraCrypt experiencing a similar situation. Both developers claimed that Microsoft locked them out of their accounts without prior notification.
In the situation concerning VeraCrypt, which is relied upon by hundreds of thousands of users to secure files and operating systems, its developer Mounir Idrassi conveyed to TechCrunch that being barred from his account means he cannot update the software in time for an important certificate authority expiration, which he stated might prevent certain users from starting up their systems.
Donenfeld, the WireGuard developer, told TechCrunch via email: “If there were an urgent vulnerability to fix at this moment — there isn’t! I’m just speaking hypothetically — then users would be completely vulnerable.”
WireGuard is a globally utilized open source VPN software that connects devices via the internet. Its code is well-regarded for its simplicity and security, serving as the basis for numerous VPN implementations and commercial services that depend on its code, such as Proton and Tailscale.
Donenfeld communicated to TechCrunch in an email that he has dedicated the last few weeks to modernizing WireGuard’s Windows code and was prepared to submit an updated copy to Microsoft for review prior to its release to users, but encountered an “access restricted” error when attempting to log into the developer section of his Microsoft account.
Despite completing the process to authenticate his driver’s license or passport with Microsoft (the third-party Microsoft employs for verification stated he was “verified”), Donenfeld reported that his access remained suspended.
Donenfeld found a page on Microsoft’s website indicating that the company had been conducting “mandatory account verification for all partners in the Windows Hardware Program who have not completed account verification since April 2024,” though the verification initiative has since concluded.
Microsoft’s Windows Hardware Program permits developers like Donenfeld and VeraCrypt’s Idrassi to “deploy hardware and device drivers for Windows PCs and other devices.” The ability to craft and distribute drivers for Windows users is confined to recognized and vetted developers, as drivers can provide extensive access to an operating system and its data, which are often exploited by hackers.
This account verification process necessitated that developers upload government-issued ID before they could publish potentially sensitive code to the larger Windows user community.
“Microsoft never sent me any notification whatsoever about this. I’ve checked every inbox, every spam folder, and every mail log, and found absolutely nothing,” Donenfeld stated.
The Windows Hardware Program’s verification initiative has “now concluded” and developers who did not upload their documents had their accounts “suspended,” the page indicates, which means these accounts can no longer provide updates.
Donenfeld mentioned that he was directed to Microsoft’s executive support team, which manages customer service and account inquiries for high-profile clients, confirming that his appeal was acknowledged, but they may take up to 60 days for assessment.
By late Wednesday, there was a hint of optimism in Donenfeld’s scenario. He informed TechCrunch that he has finally made contact with Microsoft and is hopeful for a swift resolution.
Microsoft did not provide immediate comments when contacted by TechCrunch.
Donenfeld and Idrassi are not isolated in this situation, as the account lockout problems are impacting others too.
Windscribe, a developer of VPN and other consumer privacy solutions, announced in a post on X that it had also faced lockout from its Partner Center account. The company stated that it maintained a verified account for over eight years to sign its drivers.
“We’ve been attempting to resolve this for more than a month, with no progress. Support is nonexistent,” Windscribe expressed in its post. “Is there anyone who knows a competent person at Microsoft who can assist?”