11 ms·
Microsoft terminates VeraCrypt account, halting Windows updates
https://archive.ph/Oc85c https://archive.ph/Oc85c
- msla 6mo agoWith Windows, you get what you pay for. In this case, that's an OS controlled by an unaccountable company that can take application software away from you. Related: If you're the customer, you're the product.
- Already__Taken 6mo agoWindows actually isn't very cheap.
- stronglikedan 6mo agoagree, because "free" can be neither "cheap" nor "expensive"
- jonathanstrange 6mo agoIt's not free at all. If you buy Windows through the official channels it's quite expensive. If you buy it on the grey market, it's dirt cheap, though.
- BizarroLand 6mo agoAnd even if you pay $1,000,000/day to use it, it still spies on you and sells your data to outsiders.
- shiroiuma 6mo agoExactly, yet lots of people are happy to keep using it and paying the price to do so, despite the existence of free and far superior alternatives.
- dark-star 6mo agoyou can always either disable secureboot and driver signature verification, or (the better solution) just enroll your own certificate in your TPM and sign the driver with that...
- malfist 6mo ago> or (the better solution) just enroll your own certificate in your TPM and sign the driver with that... I'll tell Grandma that's what she needs to do.
- pixel_popping 6mo agoMake sure that she setup a PKI infrastructure to manage certificate revocation as well, wouldn't want a bad grandson to mess with it.
- p_ing 6mo agoWhy would you put Grandma on VeriCrypt in the first place? It's the more 'difficult' option for FDE.
- unethical_ban 6mo agoWhat's easier, and bitlocker doesn't count. I want my FDE to be based on a password or a keyfile, not simply by some code in the motherboard. I want it encrypted until I, the operator, provide some data to unlock. In my limited experience with bitlocker, the disk is decryptable automatically as long as it's in the original motherboard.
- p_ing 6mo ago> and bitlocker doesn't count. Wat? Bitlocker is the answer to your question. > In my limited experience with bitlocker, the disk is decryptable automatically as long as it's in the original motherboard. It's unlocked (not decrypted) when the OS boots, yes. You can optionally enforce (not on Home) other unlock methods, such as PIN before the OS boots. > I want my FDE to be based on a password or a keyfile, not simply by some code in the motherboard. That's less secure than TPM.
- subscribed 6mo agoHmmm, so basically Google but you also pay for it?
- kgwxd 6mo agoChromeOS and Android are definitely comparable.
- panzi 6mo agoI see what you did there.
- nubinetwork 6mo agohttps://news.ycombinator.com/item?id=47686549 https://news.ycombinator.com/item?id=47686549
- Tempest1981 6mo agoThanks, the previous title was easy to miss: "Veracrypt project update"
- account42 6mo agoHN's guidelines for submission titles can be really counterproductive sometimes.
- deleted 6mo ago[deleted]
- Lihh27 6mo agoheh the same company that controls your secure boot chain just killed the signing account for the tool that encrypts your disk
- ai5iq 6mo agoThis is the same pattern playing out everywhere. The platform giveth, the platform taketh away. If your software's distribution depends on one company's good graces, you don't really ship it they do
- salawat 6mo agoBut nooooooo. All of us screaming bloody murder about UEFI Secure Boot impl's and code signing, and how they were the fundamental primitives to locking users out of general computation were the "paranoid" ones. The entire Trusted Computing initiative had exactly one benefactor, and it was people looking to constrain what you did on your own machine. Y'all just set up your "End-of-Analysis" goalposts too early, and blinded yourselves to the maliciousness bundled in silver tongued beneficent intentions. We'd be better off as a society all recognizing the inherent risk of computation than lulling people into a habit of "trust us bro" espoused by platform providers. Anyone trying to sell Trust is someone you can't afford to be trusting of. I'll live with the threat of rootkits if it means no one can pull this kind of shit.
- deleted 6mo ago[deleted]
- ChrisArchitect 6mo ago[dupe] https://news.ycombinator.com/item?id=47686549 https://news.ycombinator.com/item?id=47686549
- 20k 6mo agoThere's a good reason everyone calls them microslop these days. The sooner we're all able to ditch this crappy company, the better - they're actively holding back the tech industry at this point
- tonyedgecombe 6mo agoThey have been holding back the tech industry for decades now.
- BigTTYGothGF 6mo agoLooking at the rest of the tech industry in 2026 that might be a blessing.
- embedding-shape 6mo agoTo be fair, the tech industry been holding itself back for decades now too, since lots of people seemingly have somewhat low prices to go from being a FOSS evangelist to wearing a "Microsoft <3 Open Source" t-shirt.
- trueno 6mo agothat's just a byproduct of "job creators" holding the keys to a comfortable life over everyones head. i dont think its fair to conflate the tech industries self-owns with microsofts damages. microsoft has for decades poured untold resources and money into capturing everything they possibly could to sustain themselves with honestly what i call cultural and software vendor lock. we're only just now seeing the gaming industry take its first real footsteps towards non-windows targets, but for the most part the decades of evangelizing Microsoft apis and bankrolling schools and education systems to carry courses for their way of doing things makes that a particularly uphill battle thats going to take a lot more time. people have built entire careers out of the microsoft-way in multiple industries. pure microsoft houses are still everywhere at many orgs, so many of them don't even recognize that there is another path. there's plenty of infra/dbadmin/devops people who are just pure windows still. there's multiple points where microsoft did have the best in class solution for something, but these days you'd be hard pressed to not go another way if you were starting from scratch. problem is such a lift and shift is really hard to do for orgs that have spent decades being a microsoft shop. in a roundabout way, this sort of translates to real long lasting impact/damage to me. microsoft has always been such a force over history that it caused a massive rift in computing. no matter how much they embrace linux and claim to not fight the uphill battle of open source anymore, that modus operandi of locking people into their suite of things still exists on so many fronts and is in some ways more in your face than it's ever been. there's no benefit of the doubt to give here, i just have a hard time choosing microsoft for... well anything.
- trowaway2 6mo ago[dead]
- romaniv 6mo agoI still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.
- astrobe_ 6mo agoI don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.
- 201984 6mo agoAnd what if that customer wants to run their own firmware, ie after the manufacturer goes out of business? "Security" in this case conveniently prevente that.
- gjsman-1000 6mo agoTradeoffs. Which is more likely here? 1. A customer wants to run their own firmware, or 2. Someone malicious close to the customer, an angry ex, tampers with their device, and uses the lack of Secure Boot to modify the OS to hide all trace of a tracker's existence, or 3. A malicious piece of firmware uses the lack of Secure Boot to modify the boot partition to ensure the malware loads before the OS, thereby permanently disabling all ability for the system to repair itself from within itself Apple uses #2 and #3 in their own arguments. If your Mac gets hacked, that's bad. If your iPhone gets hacked, that's your life, and your precise location, at all times.
- samlinnfer 6mo ago1. P(someone wants to run their own firmware) 2. P(someone wants to run their own firmware) * P(this person is malicious) * P(this person implants this firmware on someone else’s computer) 3. The firmware doesn’t install itself Yeah I think 2 and 3 is vastly less likely and strictly lower than 1.
- onehair 6mo agoThey should have also picked up that WireGuard Creator account also got his account terminated
- tsujamin 6mo agoThey did, just further into the article: > According to a post on Hacker News, the popular VPN client WireGuard is facing the same issue.
- onehair 6mo agoI meant to say, in the title. As Wireguard is way more popular than VeraCrypt...
- RajT88 6mo agoWireguard will get fixed. Microsoft is building things on top of it: https://learn.microsoft.com/en-us/azure/aks/container-network-security-wireguard-encryption-concepts https://learn.microsoft.com/en-us/azure/aks/container-networ...
- shevy-java 6mo agoMicrosoft wants to control computers. This is why they came up with InsecureBoot - or ad-hoc eliminating accounts willy-nilly style. Microsoft kind of acts like Google here. It is also interesting that the US government is doing absolutely nothing against this despicable behaviour.
- red-iron-pine 6mo agothe US government is owned by corporate interests and has been in some capacity since inception. special mention to the Russians and Israelis and Saudis who also own a piece.
- dns_snek 6mo agoThis is precisely why we can't allow platform-owners to be the arbiters of what software is allowed to run on our devices. Any software signing that is deemed to be crucial for ensuring grandma-safety needs to be delegated to independent third parties without perverse incentives. This is what the Digital Markets Act is supposed to protect developers against. Have there been any news regarding EU's investigation into Apple? Last I remember they were still reviewing their signing & fee-collection scheme.
- duped 6mo agoThere is nothing stopping you from using third party certificates to sign Windows binaries. It's just expensive. You don't even need a MS toolchain or CLI tool for it.
- dns_snek 6mo ago> “Users who have enabled system encryption with VeraCrypt may face boot issues after July 2026 because Microsoft will revoke the [certificate authority] that was used to sign the VeraCrypt bootloader,” Idrassi said. “A new Microsoft CA must be used for bootloaders to continue working.” > Without access to the Microsoft account used for sending software updates, “I will not be able to apply the required new signature to VeraCrypt, making it impossible to boot.”
- Capricorn2481 6mo ago> It's just expensive So yes there is.
- duped 6mo agoHaving a fee that's trivial for serious software developers but too high for script kiddies shipping trash is a good thing.
- stefs 6mo agoBut that's also a fee that's trivial for well funded criminal malicious parties shipping harmful trash but too high for serious open source developers shipping free software.
- VadimPR 6mo agoA year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform. A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially since there no human support available at all, for a product I was willing to pay and use! We ended up getting our certificate sourced from https://signpath.org https://signpath.org and have been grateful to them ever since.
- tsujamin 6mo agoFor what it’s worth, Trusted Signing verification has been a moving target over the last 12 months. It was open for individuals, then it was closed to anyone except (iirc) US businesses with DUNS numbers, then it opened again to US based individuals (and a few other countries perhaps). My completely uninformed guess was that someone had done something naughty with Trusted Signing-issued code signing certificates. Anyway, when I first saw the VeraCrypt thing this morning my initial reaction was “I wonder if this is them pushing developers onto trusted signing the hard way?”
- VadimPR 6mo agoI'm in Europe and ended up creating an organization since I have my own company, but they messed up the verification of one of the legitimate documents, and there was no way to reach them once they made that mistake. Frustrating, and definitely a lost customer for them.
- michaelt 6mo agoI don't know anything about Trusted Signing verification, but I do know from reports on 'mini umbrella company fraud' that if you're a fraudster, there are people in the Philippines who will happily sign their name to western countries' official paperwork in exchange for $2000 or so. Understandably, as that's more than the country's median annual income. So I can see why offering trusted signing for individuals worldwide would come with certain challenges.
- avipars 6mo agohttps://archive.md/Oc85c https://archive.md/Oc85c
- saltamimi 6mo agoI'm confused why they can't just generate their own signing key and deploy it alongside the installer. Using arbiter platforms like this sounds like a great way to footgun yourself.
- Someone1234 6mo agoBecause a bad guy can also generate their own signing key and deploy it alongside the installer. See Notepad++ for how that winds up.
- saltamimi 6mo agoThen you can publish the public Code Signing certificate for download/import or publish it through WinGet. Using Azure Trusted Signing or any other certificate vendor does not guarantee that a binary is 100% trustworthy, it just means someone put their name on it.
- billziss 6mo agoIt is not just VeraCrypt that has been affected by this. There is a bunch of Windows driver developers that have been suddenly kicked out of the "Partner Center" without explanation. https://community.osr.com/t/locked-out-of-microsoft-partner-center-driver-submission-page/60061 https://community.osr.com/t/locked-out-of-microsoft-partner-...
- valeriozen 6mo agoWe are seeing the dark side of "Security as a Service". When Microsoft simplifies the signing pipeline (like with Trusted Signing), they also centralize the point of failure. The fact that a FOSS pillar like VeraCrypt can be sidelined due to what looks like an automated account flagging issue with no path to human arbitration shows that the current system is too fragile for critical infrastructure. Secure Boot is a great security feature, but it shouldnt be used as a tool for vendor lock in through administrative incompetence
- Jigsy 6mo agoWindscribe is now the third one to be terminated by Microsoft as well... https://nitter.net/windscribecom/status/2041929519628443943 https://nitter.net/windscribecom/status/2041929519628443943
- number201724 6mo ago5eplay.com has also been suspended, as well as my company.
- blindriver 6mo agoIt's okay. I'm pretty sure after 40+ years of using Microsoft products I'm going to switch fully to Linux and MacOS. I'm tired of fighting against Microsoft even though I am a long time (and mostly happy) user of Windows. But whatever is going on in the last few years, especially Recall, has made it dangerous in my opinion to keeping Windows. So as they become and more draconian it only makes my decision easier and easier. I've had Macs and Macbooks for a while now but I bought the latest Macbook Pro and I'm very very happy with it, despite Glass (I barely notice any differences from the previous version).
- MetroWind 6mo agoApple has trained people to believe their software needs to be signed by someone they don't know or trust.
- fuckinpuppers 6mo agoHopefully this is just boot issues, and not VC in general moving forward for now. I just centralized on leveraging VC for container encryption. I actually moved away from VC back to Bitlocker for FDE just a couple weeks ago (I forget the exact reasons why) But I still like it for containers, and I hope they can figure out a way to get it fixed for VC and WireGuard or they can figure out alternate signing options and a migration path.