The developer of WireGuard VPN cannot send software updates after Microsoft locks the account

WireGuard, the major software project and VPN that underpins popular security software including Mullvad and others, has found itself locked out of a key part of its Microsoft developer account and unable to send software updates to Windows users.

Jason Donenfeld, the creator of the open-source WireGuard VPN software, told TechCrunch that he was locked out of his Microsoft developer account and as a result could not sign drivers or send updates to WireGuard for Windows users that are critical to the software’s operation. Donenfeld said in an X post on Wednesday that terminating the account stopped WireGuard from sending an update.

This is the second such incident of a high-profile and widely used open source project being disconnected from its customers due to a seemingly sudden account termination by Microsoft, with the popular encryption software VeraCrypt facing a similar circumstance. Both developers said Microsoft locked them out of their accounts without warning them first.

In the case of VeraCrypt, which is used by hundreds of thousands of users to encrypt files and operating systems, its developer Munir Idrasi told TechCrunch that his account ban meant he couldn’t update the software in time for an important certificate authority to expire, which he said could prevent some users from booting.

Donenfeld, the developer of WireGuard, told TechCrunch in an email: « If there was a critical vulnerability to patch right now – no! I just mean hypothetically – then users would be completely exposed. »

WireGuard is an open source VPN software used worldwide to connect devices over the Internet. WireGuard’s code is very popular for its simplicity and security, as it serves as the basis of many VPN implementations and commercial services that rely on its code, such as Proton and Tailscale.

Donenfeld told TechCrunch in an email that he had spent the past few weeks modernizing WireGuard’s Windows code and was ready to send a copy of an update to Microsoft for review before it could be sent to users, but was met with a « restricted access » error when logging into the developer portion of his Microsoft account.

Although he went through the process of verifying his driver’s license or passport with Microsoft (the third party Microsoft uses for verification said it was « verified »), Donenfeld said his access was still suspended.

Donenfeld told TechCrunch that he found a page on Microsoft’s website that said the company had been performing « mandatory account verification for all Windows Hardware Program partners who have not completed account verification since April 2024, » but that the verification program has since been closed.

Microsoft’s Windows Hardware Program allows developers like VeraCrypt’s Donenfeld and Idrassi to « deploy hardware and device drivers for Windows PCs and other devices. » The ability to develop and release drivers for Windows users is limited to known and verified developers, as drivers can provide extensive access to an operating system and its data, and are known to be abused by hackers for this reason.

This account verification process meant that developers had to upload their government-issued ID before being allowed to publish potentially highly sensitive code to the wider Windows user base.

« Microsoft never sent me any notification about this. I looked in every inbox in every spam folder in every mail log and zero, nothing, nothing, » Donenfeld said.

The Windows Hardware Checker program has « now ended » and developers who haven’t uploaded their documents have been « suspended, » the page says, meaning those accounts can no longer submit updates.

Donenfeld said he was referred to Microsoft’s executive support team, which handles customer service and VIP account requests, who confirmed that his appeal had been received, but that it had to wait up to 60 days for a review.

As of late Wednesday, there was a glimmer of hope in Donenfeld’s case. He told TechCrunch that he has finally reached out to Microsoft and that hopefully the issue will be resolved soon.

Microsoft did not immediately comment when contacted by TechCrunch.

Donenfeld and Idrasi are not alone, with account lockout issues affecting others as well.

Windscribe, a maker of VPNs and other consumer privacy tools, said in a post on X that it was also locked out of its Partner Center account. The company said it has had a verified account for more than eight years to sign its drivers.

« We’ve been trying to resolve this for over a month and getting nowhere. Support is non-existent, » Windscribe said in its post. « Anyone know a guy with a brain who still works at Microsoft who can help? »