WireGuard VPN developer can’t ship software updates after Microsoft locks account

The WireGuard VPN project, known for its foundational role in various security applications, is currently unable to release essential updates for Windows users due to a lockout from its Microsoft developer account. Jason Donenfeld, the creator of this open-source software, shared with TechCrunch that this unexpected account termination has hindered his ability to sign drivers and distribute updates, which are vital for the software's functionality. On social media, Donenfeld expressed his frustration, revealing that the lockout prevented a planned update from being released. This incident marks a troubling trend in which high-profile open-source projects, such as VeraCrypt, are finding themselves similarly restricted by abrupt actions from Microsoft. The developers of both WireGuard and VeraCrypt reported that they were not given any prior notice before losing access to their accounts. Mounir Idrassi, the developer behind VeraCrypt, highlighted the urgency of the situation, stating that being locked out could result in users facing significant issues, particularly with an impending certificate authority expiry. Donenfeld emphasized the potential risks, even hypothetically, if a critical vulnerability were to emerge while updates cannot be deployed. WireGuard is widely recognized for its simplicity and security, serving as the backbone for numerous commercial VPN services. Donenfeld mentioned that he had been working diligently to modernize the Windows version of WireGuard and was ready to submit it for approval when he encountered an “access restricted” message. Despite completing the necessary verification steps with Microsoft, including submitting identification, Donenfeld remained unable to regain access. He discovered a notice on Microsoft’s website indicating that a mandatory account verification process had recently concluded, which left many developers, including himself, in a lurch. The Windows Hardware Program, designed to manage driver deployment, requires developers to undergo stringent verification to ensure security and integrity. This process is crucial because drivers can provide extensive access to system resources, making them a target for malicious actors. Donenfeld lamented the lack of communication from Microsoft, asserting that he had not received any notifications regarding his account status. As a result, his attempts to clarify the situation with Microsoft’s executive support team have led to a waiting period of up to 60 days for resolution. In a hopeful twist, Donenfeld reported that he was finally in touch with Microsoft and anticipated a swift resolution. However, he is not alone in facing these challenges; other developers, including the VPN service Windscribe, have also reported similar account access issues and frustrations with Microsoft’s support system. Windscribe noted that it has been trying to resolve its account lockout for over a month, highlighting the widespread impact of these sudden policy changes.