WireGuard VPN developer cannot send software updates after Microsoft account is locked

WireGuard, the major software project and VPN that powers popular security software including Mullvad and others, has found itself locked out of a key portion of its Microsoft developer account and unable to push software updates to Windows users.

Jason Donenfeld, the creator of the open source WireGuard VPN software, told TechCrunch that he has been locked out of his Microsoft developer account, and as a result he cannot sign drivers or send WireGuard for Windows users updates, which are necessary for his software to run. Donenfeld said in a post on X on Wednesday that the account termination prevented the WireGuard update from being shipped.

It’s the second such incident of a high-profile, widely used open source project being shut out of its customers due to Microsoft’s apparent sudden account termination, with popular encryption software VeraCrypt facing similar circumstances. Both developers said Microsoft closed their accounts without alerting them first.

In the case of VeraCrypt, which is used by hundreds of thousands of users to encrypt files and operating systems, its developer Mounir Idrassi told TechCrunch that having his account locked means he is unable to update the software in time for the expiration of crucial certificate authority, which he said could prevent some users from running.

“If there was a critical vulnerability that needed to be fixed now — it doesn’t exist! I mean just in theory — users would be completely exposed,” Donenfeld, WireGuard’s developer, told TechCrunch in an email.

WireGuard is an open source VPN software used around the world to connect devices over the Internet. WireGuard’s code is so popular for its simplicity and security that it serves as the basis for many VPN applications and commercial services that rely on its code, such as Proton and Tailscale.

Donenfeld told TechCrunch in an email that he spent the last few weeks updating the Windows code for WireGuard and was prepared to send an update copy to Microsoft for checks before it could ship to users, but was met with an “access restricted” error when logging into the developer pane of his Microsoft account.

Although he has undergone verification of his driver’s license or passport with Microsoft (the third party Microsoft uses for verification said it is “verified”), Donenfeld said his access is still pending.

Donenfeld told TechCrunch that he found a page on Microsoft’s website stating that the company had been implementing “mandatory account verification for all partners in the Windows Device Program who have not completed account verification since April 2024,” but the verification program has since been shut down.

Microsoft’s Windows Device Program allows developers like Donenfeld and VeraCrypt’s Idrassi to “publish devices and device drivers for Windows PCs and other devices.” The ability to develop and release drivers for Windows users is limited to known and vetted developers, as drivers can grant broad access to the operating system and its data and are known to be abused by hackers for this reason.

The account verification process means that developers must upload a government-issued ID before they are allowed to publish code that could be highly sensitive to the broader Windows user base.

“Microsoft never sent me any notice about this,” Donenfeld said. “I searched every inbox, every spam folder, every mail log, and I found nothing, nothing.”

The Windows Device Verification Program has “now ended,” the page says, and developer accounts who have not uploaded their documents have been “suspended,” meaning those accounts can no longer submit updates.

Donenfeld said he was referred to Microsoft’s executive support team, which handles customer service and account requests for high-profile individuals, which confirmed receipt of his appeal but they had to wait up to 60 days for review.

By late Wednesday, there was a glimmer of hope in Donenfeld’s case. He told TechCrunch that he has finally been in contact with Microsoft and that the issue will hopefully be resolved soon.

Microsoft did not immediately comment when contacted by TechCrunch.

Donenfeld and Idrasi are not alone, as account closure issues are affecting others as well.

Windscribe, the maker of VPNs and other consumer privacy tools, said in a post on X that it had also been blocked from accessing its Partner Center account. The company said it has had a verified account for more than eight years in order to sign on for its drivers.

“We’ve been trying to resolve this issue for over a month, and haven’t gotten anywhere. Support is nonexistent,” Windscribe said in its post. “Does anyone know of a human with a brain who still works at Microsoft who can help?”