WireGuard, the main software project and VPN behind popular security software including Mullvad and others, has locked itself out of its Microsoft developer account core and is unable to push software updates to Windows users.
Jason Donenfeld, the creator of the open-source WireGuard VPN software, told TechCrunch that he was locked out of his Microsoft developer account, which resulted in him being unable to sign drivers or push updates that are essential for the WireGuard software to work for Windows users. Donenfeld said In an article on X account cancellation on wednesday stopped sending the WireGuard update.
this second such incident a high-profile and widely used open-source project facing a similar situation as the popular encryption software VeraCrypt, which lost customers due to Microsoft’s sudden account termination. Both developers said Microsoft blocked them from their accounts without first notifying them.
In the case of VeraCrypt, which is used by hundreds of thousands of users to encrypt files and operating systems, its developer Mounir Idrassi told TechCrunch locking out his account means he can’t update the software in time for an important certificate authority to expire, which he says could prevent some users from downloading.
WireGuard developer Donenfeld told TechCrunch in an email: “If there was a critical vulnerability to patch right now — there isn’t! I mean just hypothetically — then users would be completely exposed.”
WireGuard is an open source VPN software used around the world to connect devices over the internet. WireGuard’s code is well-known for its simplicity and security, as it serves as the foundation for many VPN applications and commercial services that rely on its code, such as Proton and Tailscale.
Donenfeld told TechCrunch in an email that he spent the past few weeks modernizing WireGuard’s Windows code and was ready to send a copy of the update to Microsoft for checks before it was released to users, but he encountered an “access restricted” error when logging into the developer section of his Microsoft account.
Despite going through the process of verifying his driver’s license or passport with Microsoft (the third party Microsoft used for verification said it was “verified”), Donenfeld said his access was still suspended.
Donenfeld told TechCrunch that he Found a page on Microsoft’s website said the company implemented “mandatory account verification for all Windows Hardware Program partners who have not completed account verification since April 2024,” but that the verification program has since been shut down.
Microsoft’s Windows Deployment Program allows developers like Donenfeld and VeraCrypt’s Idrassi to “deploy hardware and device drivers for Windows PCs and other devices.” The ability to develop and release drivers for Windows users is limited to recognized and verified developers, as drivers can and are known to provide extensive access to the operating system and its data. misused by hackers for this reason.
This account verification process meant that developers were required to upload government-issued IDs before being allowed to publish potentially highly sensitive code to the wider Windows user base.
“Microsoft has never notified me about this. I’ve looked in every inbox, every spam folder, every mail log, and zero, nothing, zilch,” Donenfeld said.
The page says that the Windows Hardware Program verification program has “now ended” and that developer accounts that haven’t uploaded their documentation have been “suspended,” meaning those accounts can no longer submit updates.
Donenfeld said she was referred to Microsoft’s executive support team, which handles customer service and account inquiries for high-profile individuals, which confirmed her request had been received but said they would have to wait 60 days for a review.
By the end of Wednesday, there was a glimmer of hope in Donenfeld’s case. He told TechCrunch that he has finally contacted Microsoft and hopes the issue will be resolved soon.
Microsoft had no immediate comment when reached by TechCrunch.
Donenfeld and Idrassi are not alone, account ban issues are affecting others as well.
Windscribe, a maker of VPNs and other consumer privacy tools, said In an article on X he is also banned from his Partner Central account. The company said it has had a verified account for more than eight years to sign up its drivers.
“We’ve been trying to resolve this for over a month with no luck. No support,” Windscribe said in a post. “Does anyone know someone with a brain who still works at Microsoft and can help?”
