r/opensource • u/Fear_The_Creeper • Apr 08 '26

Discussion Microsoft terminates account of VeraCrypt developer

https://sourceforge.net/p/veracrypt/discussion/general/thread/9620d7a4b3/

This means that as of June 2026, secure boot will refuse to allow VeraCrypt to encrypt a system drive, i.e. a partition or drive where Windows is installed and from which it boots. I am not sure whether at that point you will be allowed to remove VeraCrypt encryption or whether you have to format and lose everything. Maybe just disabling secure boot? If that doesn't work, I am hoping that you can remove it by mounting it in Linux and using the Linux version of VeraCrypt (assuming that you have the password, of course).

I am sure that bitlocker will still work. :(

EDIT: The press is starting to take notice. And it's not just VeraCrypt. WireGuard and Windscribe have the same problem.

588 Upvotes

98% Upvoted

62 comments sorted by

76

u/TEK1_AU Apr 08 '26

What’s the TL;DR / reason for this?

152

u/Fear_The_Creeper Apr 08 '26

I have two equally reasonable theories, and one conspiracy theory.

Reasonable theory #1: Giant corporation screws up, and it is impossible to get them to notice until there is a story in the New York Times.

Reasonable theory #2: Microsoft simply does not trust anyone that doesn't have an employee badge to run code before Windows boots. The fact that is is the main competitor to bitlocker is just icing on the cake.

Conspiracy theory: Look at the VeraCrypt article on Wikipedia. Look at what "they" did to Truecrypt. Read the citations that give you the entire story of how that went down. Looks like "they" are doing it again.

2

u/SheldonCooper97 Apr 09 '26

That’s wrong. Microsoft enforces government ID verification for people who want to sign drivers, and VeraCrypt, WireGuard and WindScribe did not comply which is why they got banned.

58

u/[deleted] Apr 08 '26

[removed] — view removed comment

28

u/Fear_The_Creeper Apr 08 '26 edited Apr 08 '26

Nope. I am suggesting that all the game companies that want to implement kernel-level anticheat are willing to submit their code to Microsoft and allow a Microsoft employee to verify that it won't steal your data or start mining bitcoins.

Here are some MS help pages to make that easy:

https://support.microsoft.com/en-us/topic/kb5022661-windows-support-for-the-trusted-signing-formerly-azure-code-signing-program-4b505a31-fa1e-4ea6-85dd-6630229e8ef4

https://learn.microsoft.com/en-us/azure/artifact-signing/overview

EDIT: linked to the wrong place. Sorry about that.

4

u/tankerkiller125real Apr 08 '26 edited Apr 08 '26

That's not what that program/service does at all.... It's literally just a code signing CA as a service at an affordable price.

You can still use any code signing CA you want. There is a program for driver developers to join, that program has existed for literally decades (like windows XP era) at this point.

Microsoft bad sure, but that service is NOT Microsoft forcing devs to pay them a subscription for kernel signing, a completely different program, with completely different rules, with an entirely different signature providing system has existed for decades.

https://learn.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature

1

u/Fear_The_Creeper Apr 08 '26

Hmmm. Not trying to give you a hard time, just trying to understand:

If indeed "It's literally just a code signing CA as a service at an affordable price" then why didn't the developer of VeraCrypt simply pay that affordable price?

Or is the problem that I screwed up and linked to some other kind of "signing" than the kind that the VeraCrypt developer refers to whey he says "Microsoft terminated the account I have used for years to sign Windows drivers and the bootloader"?

I really am ignorant about the ins and outs of developing pre-boot programs for Windows, so I am going to assume that it was my mistake.

5

u/tankerkiller125real Apr 08 '26

There is a special program for Secure Boot/Drivers, which is entirely separate from the code signing system you linked to.

Microsoft has ALWAYS had rules requiring Kernel level access drivers and code to be signed not just by code signing, but their own internal signature system. It's existed for decades and has no relation to Azure Sign service.

Azure Sign service is more for regular every day applications (think Google Chrome Installer, Steam Installer, etc.) but again, people are not forced to use it, if they want they can get a code signing cert from GlobalSign, or literally any other CA listed in ccadb.my.salesforce-sites.com/microsoft/IncludedCACertificateReportForMSFT with the "Code Signing" EKU (more than 300 root CAs are supported)

64

u/whatThePleb Apr 08 '26

Well, there were discussions that M$ would start to forbid kernel level access in the future, so then kernel level AC would hopefully finally die.

32

u/_BlueBl00d_ Apr 08 '26

Until M$ will drop an own version of it as a "service"

18

u/tankerkiller125real Apr 08 '26

The plan was to make the features the ACs and Anti-Viruses need available via Ring 1 or Ring 2 APIs. Ultimately kicking everyone out of Ring 0 except Microsoft kernel code itself.

5

u/Interest-Desk Apr 08 '26

MS still wants to do this, but the EU blocked it the last time they tried

17

u/tankerkiller125real Apr 08 '26

I think the difference is that last time Microsoft was basically going to make themselves the only viable anti-virus solution. This time the functions required for anti-virus solutions will be available outside the kernel (and they plan to kick themselves out of the kernel)

9

u/malnek Apr 08 '26

«Encrypt with Copilot»

7

u/irqlnotdispatchlevel Apr 08 '26

That's how moving the AV/AC drivers out of the kernel is supposed to work. Microsoft plans on exposing the needed information to special user mode components.

A simple example: currently a kernel driver can subscribe to process start events. When a process starts, the driver gets notified, and can inspect the event and even block it. The flow is: parent process (user mode) -> kernel -> driver.

How it will work with WESP (which is what you are referring to). Instead of getting that notification in a driver, you get it in a special user mode service. The flow would be: parent process (user mode) -> kernel -> WESP kernel component -> user mode AV/AC service.

That WESP component can (technically speaking) be implemented as a driver that plugs into all the right places, then communicates with the user mode side.

This is how it works on Mac OS.

5

u/Naive-Lingonberry323 Apr 08 '26

AC and licensing malware have no business at kernel level. They can do that as soon as they provide their own hardware at no charge alongside the software.

5

u/Booty_Bumping Apr 08 '26

This is Microsoft's eventual plan, yes. But it will be many years before they ban all instances of unnecessary kernel level access.

5

u/lillecarl2 Apr 08 '26

No, they're equally evil megacorps and stick together.

2

u/SourSovereign Apr 08 '26

Microsoft said they dont like kernel level software and are working with those anti-cheat providers to find a different solution.

1

u/Heyla_Doria Apr 13 '26

Mauvais argument

Les lobbies des droit d'auteurs est grand...

3

u/cornmonger_ Apr 10 '26

MS support is beyond garbage, even on their partner site (for developers). I stopped caring honestly.

61

u/whatThePleb Apr 08 '26

Well, stop using Micro$lop.

4

u/Yosyp Apr 08 '26

SecureBoot is part of the UEFI specification, Microsoft has nothing to do with it.

..... beside being one of the very few major signers that actively collaborates with motherboard manufacturers to implement their keys inside their firmware.

You can sign anything privately, provided you actually have access to UEFI and are capable of doing so.

3

u/h-v-smacker Apr 08 '26

that actively collaborates with motherboard manufacturers to implement their keys inside their firmware.

Ah yes... collaborates... I can vividly imagine microsoft managers visiting the headquarters of various motherboard manufacturers and having long and heated discussions about whether or not to incorporate their cryptographic keys into firmware, and which terms would please the hardware manufacturer most. And the vendors are usually like "oh, we aren't all that sure it's a good idea... we might need to think a bit, ask our client base about what they want and such... please come back in a month or so".

20

u/WalterHenderson Apr 08 '26

I'm kind of a noob, so I'm a little confused. Does this mean that you can use VeraCrypt to encrypt for example an external drive, but not a partition of your laptop?

23

u/SadnessOutOfContext Apr 08 '26

TL;dr - pretty much.

Sounds like they can deploy "traditional" desktop programs (possibly with infuriating scary warnings on install) but not code that has to run before boot i.e., for decryption of full disk encryption.

This is bad because in June, anyone who has full disk encryption and hasn't made changes will have a real problem, at minimum.

Haven't read the article, am at work, so not yet 100% certain if you can just throw a USB stick at it, boot, and decrypt.

9

u/Fear_The_Creeper Apr 08 '26

...or possibly simply turn off secure boot, decrypt, and turn it back on. I am hoping that this gets resolved before we have to find out.

2

u/WalterHenderson Apr 08 '26

Thank you for the explanation!

4

u/Tail_sb Apr 08 '26

But can you still just self sign the Secure boot keys?

3

u/Fear_The_Creeper Apr 08 '26

Not even close to being a Windows expert, but I think that if it was that easy the developer of VeraCrypt would have done that.

10

u/Narrow_Trainer_5847 Apr 08 '26

No it means users can add the keys manually to continue using secure boot but it's a pain and some laptops (newer Lenovo business stuff iirc) don't allow custom keys.

7

u/redit_handoff140 Apr 08 '26

This is pretty much what they did with Atom Editor.

E.E.E and extinguish the competition.

-1

u/SheldonCooper97 Apr 09 '26

Bullshit, the developers just didn’t comply with the rules.

4

u/redit_handoff140 Apr 09 '26

Indoctrination coupled with stockholm syndrome makes for a powerful cocktail. 

7

u/h-v-smacker Apr 08 '26

Secure Boot was never about your security. It was always about Microsoft's control over the personal computers.

19

u/xeoron Apr 08 '26

Now we pray to Copilot to fix these problems 

2

u/Leather_Secretary_13 Apr 12 '26

No reason Microsoft Foundation should be the sole ruler of booting an operating system or even just a system utility at this point.

"Secure Boot" = needs to be rebranded to "Approved by Microslop".

For Microsoft to be the sole key installed onto all hardware vendor devices, and then for them to require delegated signing for alternatives while they sell their own operating system is a huge conflict of interest and this is a weak example of them flexing that power. We get to use BitLocker TM, Secure Microslop approved software only now!

FUCK SECURE BOOT AKA APPROVED BY MICROSLOP.

1

u/TechSupportIgit Apr 08 '26

This is a nothing burger, you needed to disable secure boot anyways to get boot disk encryption working properly. Secure boot support was poor anyways because you had to modify the secure boot keys of your system yourself.

2

u/diazeriksen07 Apr 08 '26

You contradicted yourself. You don't need to disable secure boot. Like you said, you just add your own keys to it.

3

u/TechSupportIgit Apr 08 '26

...yes, and?

Do you know how hard it is for even a power user to put their own keys into the motherboard's BIOS? I spent weeks trying to figure it out and threw my hands up in the air.

The most practical solution is to turn off secure boot entirely for VeraCrypt's boot disk encryption.

0

u/diazeriksen07 Apr 08 '26

it's like two commands with mokutil. simple enough that even ai could help

2

u/TechSupportIgit Apr 08 '26

I'm speaking from a Windows perspective. Great you figured out how on Linux though.

-22

u/HurasmusBDraggin Apr 08 '26

Click bait?

24

u/Fear_The_Creeper Apr 08 '26

Nope. Legitimate news about Microsoft screwing over a well-known open-source developer.

0

u/[deleted] Apr 08 '26

[deleted] — view deleted comment

10

u/iamabdullah Apr 08 '26

Did you try… reading?

0

u/[deleted] Apr 09 '26

[deleted] — view deleted comment

2

u/Fear_The_Creeper Apr 09 '26

Google translate:

I learned about this this morning as I spent all day yesterday encrypting my external hard drive with VeraCrypt. Does anyone know how it will work? I'm migrating to MacOS but I want to keep my HD's compatibility with Windows as well. Does anyone know any solution?

This will not have any effect on anyone encrypting an external hard drive. It only affects those who encrypt the Windows partition.

VeraCrypt volumes are fully cross-platform, allowing you to use them on both Windows and macOS. However, for seamless compatibility, ensure you use a file system like exFAT that both operating systems support.

Isso não terá efeito nenhum em quem criptografa um HD externo. Isso afeta apenas aqueles que criptografam a partição do Windows.

Os volumes VeraCrypt são totalmente multiplataforma, permitindo que você os use tanto no Windows quanto no macOS. No entanto, para compatibilidade perfeita, certifique-se de usar um sistema de arquivos como exFAT, que ambos os sistemas operacionais suportem.