Microsoft Abruptly Terminates VeraCrypt Account, Halting Windows Updates
273 points
4 hours ago
| 12 comments
| 404media.co
| HN
romaniv
2 hours ago
[-]
I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.
reply
arcfour
8 minutes ago
[-]
I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish.

Does that mean that Microsoft doesn't also use it as a form of control? Of course not. But conflating "Secure Boot can be used for platform control" with "Secure Boot provides no security" is a non-sequitur.

reply
kelseyfrog
5 minutes ago
[-]
Anything that restricts user freedom is entirely bad, even if it's at the expense of security.
reply
Groxx
41 seconds ago
[-]
[delayed]
reply
astrobe_
2 hours ago
[-]
I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.
reply
201984
1 hour ago
[-]
And what if that customer wants to run their own firmware, ie after the manufacturer goes out of business? "Security" in this case conveniently prevente that.
reply
hhh
19 minutes ago
[-]
you click the box to turn off secure boot
reply
gjsman-1000
1 hour ago
[-]
Tradeoffs. Which is more likely here?

1. A customer wants to run their own firmware, or

2. Someone malicious close to the customer, an angry ex, tampers with their device, and uses the lack of Secure Boot to modify the OS to hide all trace of a tracker's existence, or

3. A malicious piece of firmware uses the lack of Secure Boot to modify the boot partition to ensure the malware loads before the OS, thereby permanently disabling all ability for the system to repair itself from within itself

Apple uses #2 and #3 in their own arguments. If your Mac gets hacked, that's bad. If your iPhone gets hacked, that's your life, and your precise location, at all times.

reply
samlinnfer
1 hour ago
[-]
1. P(someone wants to run their own firmware)

2. P(someone wants to run their own firmware) * P(this person is malicious) * P(this person implants this firmware on someone else’s computer)

3. The firmware doesn’t install itself

Yeah I think 2 and 3 is vastly less likely and strictly lower than 1.

reply
the__alchemist
5 minutes ago
[-]
I encourage you to re-evaluate this. How many devices do you (or have you) own which have have a microcontroller? (This includes all your appliances, your clocks, and many things you own which use electricity.) How many of these have you reflashed with custom firmware?

Imagine any of your friends, family, or colleagues. (Including some non-programmers/hackers/embedded-engineers) What would their answers be?

reply
mikestew
43 minutes ago
[-]
As an embedded programmer in my former life, the number of customers that had the capability of running their own firmware, let alone the number that actually would, rapidly approaches zero. Like it or not, what customers bought was an appliance, not a general purpose computer.
reply
itsdesmond
1 hour ago
[-]
This guy thinks that if you rephrase an argument but put some symbols around it you’ve refuted it statistically.

P(robably not)

reply
samlinnfer
1 hour ago
[-]
The argument is that P(customer wants to run their own firmware) cancels out and 2,3 are just the raw probability of you on the receiving end of an evil maid attack. If you think this is a high probability, a locked bootloader won’t save you.
reply
FabHK
7 minutes ago
[-]
Very neat, but 1) is not really P(customer wants to run their own firmware), but P(customer wants to run their own firmware on their own device).

So, the first term in 1) and 2) are NOT the same, and it is quite conceivable that the probability of 2) is indeed higher than the one in 1) (which your pseudo-statistical argument aimed to refute, unsuccessfully).

reply
philistine
1 hour ago
[-]
As if the monetary gain of 2 and 3 never entered the picture. Malicious actors want 2 and 3 to make money off you! No one can make reasonable amounts of money off 1.
reply
gjsman-1000
1 hour ago
[-]
On Android, according to the Coalition Against Stalkerware, there are over 1 million victims of deliberately placed spyware on an unlocked device by a malicious user close to the victim every year.

#2 is WAY more likely than #1. And that's on Android which still has some protections even with a sideloaded APK (deeply nested, but still detectable if you look at the right settings panels).

As for #3; the point is that it's a virus. You start with a webkit bug, you get into kernel from there (sometimes happens); but this time, instead of a software update fixing it, your device is owned forever. Literally cannot be trusted again without a full DFU wipe.

reply
samlinnfer
1 hour ago
[-]
And where are the stats for people running their own firmware and are not running stalkerware for comparison? You don’t need firmware access to install malware on Android, so how many of stalkerware victims actually would have been saved by a locked bootloader?
reply
gjsman-1000
1 hour ago
[-]
The entirety of GrapheneOS is about 200K downloads per update. Malicious use therefore is roughly 5-1.

> You don’t need firmware access to install malware on Android, so how many of stalkerware victims actually would have been saved by a locked bootloader?

With a locked bootloader, the underlying OS is intact, meaning that the privileges of the spyware (if you look in the right settings panel) can easily be detected, revoked, and removed. If the OS could be tampered with, you bet your wallet the spyware would immediately patch the settings system, and the OS as a whole, to hide all traces.

reply
samlinnfer
1 hour ago
[-]
Assuming that we accept your premise that the most popular custom firmware for Android is stalkerware (I don’t). This is of course, a firmware level malware, which of course acts as a rootkit and is fully undetectable. How did the coalition against stalkerware, pray tell, manage to detect such an undetectable firmware level rootkit on over 1 million Android devices?
reply
kuschku
1 hour ago
[-]
LineageOS alone has around 4 million active users. So malicious use is at most 1:4, not 5:1.
reply
lazide
1 hour ago
[-]
Clearly you’ve never met my ex’s (or a past employer). Not even being sarcastic this time.
reply
dns_snek
1 hour ago
[-]
#2 and #3 are fearmongering arguments and total horseshit, excuse the strong language.

Should either of those things happen the bootloader puts up a big bright flashing yellow warning screen saying "Someone hacked your device!"

I use a Pixel device and run GrapheneOS, the bootloader always pauses for ~5 seconds to warn me that the OS is not official.

reply
root_axis
41 minutes ago
[-]
Yes. They're making the point that your flashing yellow warning is a good thing, and that it's helpful to the customer that a mechanism is in place to prevent it from being disabled by an attacker.
reply
tosti
1 hour ago
[-]
Computers should abide by their owners. Any computer not doing that is broken.
reply
ghighi7878
53 minutes ago
[-]
Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS.

We need this law. Once we have this law, consumers csn get maximum benefit of secure boot withiut losing contorl

reply
cferry
1 hour ago
[-]
I make the analogy with a company, because on that front, ownership seems to matter a lot in the Western world. It's like it had to have unfaithful management appointed by another company they're a customer of, as a condition to use their products. Worse, said provider is also a provider for every other business, and their products are not interoperable. How long before courts jump in to prevent this and give back control to the business owner?
reply
wat10000
1 hour ago
[-]
This gets tricky. If I click on a link intending to view a picture of a cat, but instead it installs ransomware, is that abiding by its owner or not? It did what I told it to do, but not at all what I wanted.
reply
ghighi7878
49 minutes ago
[-]
We dont need to get philosophical here. You(the admin) can require you (the user) to input a password to signify to you(the admin) to install a ransomware when a link is clicked. That way no control is lost.
reply
wat10000
37 minutes ago
[-]
What if the cat pictures are an app too? The computer can't require a password specifically for ransomware, just for software in general. The UI flow for cat pictures apps and ransomware will be identical.
reply
Galanwe
49 minutes ago
[-]
> id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with

The firmware of the device being a binary blob for the most part... Not like I trust it to begin with.

Whereas my open source Linux distribution requires me to disables SecureBoot.

What a world.

reply
WhyNotHugo
23 minutes ago
[-]
You can set up custom SecureBoot keys on your firmware and configure Linux to boot using it.

There's also plenty of folks combining this with TPM and boot measurements.

The ugly part of SecureBoot is that all hardware comes with MS's keys, and lots of software assume that you'll want MS in charge of your hardware security, but SecureBoot _can_ be used to serve the user.

Obviously there's hardware that's the exception to this, and I totally share your dislike of it.

reply
repelsteeltje
30 minutes ago
[-]
+1

An unsigned hash is plenty guard to against tampering. The supply chain and any secret sauce that went into that firmware is just trust. Trust that the blob is well intentioned, trust that you downloaded from the right URL, checked the right SHA, trust that the organization running the URL is sanctioned to do so by Microsoft...

Once all of that trust for every piece of software is concentrated in one organization, Microsoft, Apple or Google, is has become totally meaningless.

reply
mort96
52 minutes ago
[-]
It's to serve the regulators. The Radio Equipment Directive essentially requires the use of secure boot fir new devices.
reply
petcat
47 minutes ago
[-]
I happen to like knowing that my mobile device did not have a ring 0 backdoor installed before it left the factory in Asia. SecureBoot gives me that confidence.
reply
mort96
29 minutes ago
[-]
No it doesn't? The factory programs in the secure boot public keys
reply
petcat
19 minutes ago
[-]
The public keys are provided by the developer. Google, or Apple, for example. It's how they know that nothing was tampered with before it left the factory.
reply
asveikau
15 minutes ago
[-]
Apple is also somewhat responsible for the attitude shift with the introduction of iOS. 20-25 years ago a locked down bootloader and only permitting signed code would have been seen by techies as dystopian. It's now quite normalized. They say it's about security but it's always been about control.

Stallman tried to warn us with "tivoization".

reply
pjmlp
1 hour ago
[-]
If only people didn't install Ask Jeeves toolbars all over the place and then asked their grandson during vacations to clean their computer.
reply
VadimPR
1 hour ago
[-]
A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform.

A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially since there no human support available at all, for a product I was willing to pay and use!

We ended up getting our certificate sourced from https://signpath.org and have been grateful to them ever since.

reply
tsujamin
46 minutes ago
[-]
For what it’s worth, Trusted Signing verification has been a moving target over the last 12 months. It was open for individuals, then it was closed to anyone except (iirc) US businesses with DUNS numbers, then it opened again to US based individuals (and a few other countries perhaps).

My completely uninformed guess was that someone had done something naughty with Trusted Signing-issued code signing certificates.

Anyway, when I first saw the VeraCrypt thing this morning my initial reaction was “I wonder if this is them pushing developers onto trusted signing the hard way?”

reply
VadimPR
22 minutes ago
[-]
I'm in Europe and ended up creating an organization since I have my own company, but they messed up the verification of one of the legitimate documents, and there was no way to reach them once they made that mistake. Frustrating, and definitely a lost customer for them.
reply
20k
2 hours ago
[-]
There's a good reason everyone calls them microslop these days. The sooner we're all able to ditch this crappy company, the better - they're actively holding back the tech industry at this point
reply
mbix77
2 hours ago
[-]
Yea, I'm in the process of converting our complete ETL infrastructure from SSIS/SQL Server to Python/PostgreSQL. Next step is Office 365, which will be more difficult, but doable since we are a small company anyway.
reply
stvltvs
2 hours ago
[-]
Are you converting the SSIS automatically somehow or rewriting it?
reply
tonyedgecombe
2 hours ago
[-]
They have been holding back the tech industry for decades now.
reply
embedding-shape
2 hours ago
[-]
To be fair, the tech industry been holding itself back for decades now too, since lots of people seemingly have somewhat low prices to go from being a FOSS evangelist to wearing a "Microsoft <3 Open Source" t-shirt.
reply
trueno
1 hour ago
[-]
that's just a byproduct of "job creators" holding the keys to a comfortable life over everyones head.

i dont think its fair to conflate the tech industries self-owns with microsofts damages. microsoft has for decades poured untold resources and money into capturing everything they possibly could to sustain themselves with honestly what i call cultural and software vendor lock. we're only just now seeing the gaming industry take its first real footsteps towards non-windows targets, but for the most part the decades of evangelizing Microsoft apis and bankrolling schools and education systems to carry courses for their way of doing things makes that a particularly uphill battle thats going to take a lot more time. people have built entire careers out of the microsoft-way in multiple industries. pure microsoft houses are still everywhere at many orgs, so many of them don't even recognize that there is another path. there's plenty of infra/dbadmin/devops people who are just pure windows still. there's multiple points where microsoft did have the best in class solution for something, but these days you'd be hard pressed to not go another way if you were starting from scratch. problem is such a lift and shift is really hard to do for orgs that have spent decades being a microsoft shop.

in a roundabout way, this sort of translates to real long lasting impact/damage to me. microsoft has always been such a force over history that it caused a massive rift in computing. no matter how much they embrace linux and claim to not fight the uphill battle of open source anymore, that modus operandi of locking people into their suite of things still exists on so many fronts and is in some ways more in your face than it's ever been. there's no benefit of the doubt to give here, i just have a hard time choosing microsoft for... well anything.

reply
ryandrake
14 minutes ago
[-]
Microsoft has been trying to kill everything in computers that's not-Microsoft, for as long as I've been alive. Their actual power comes and goes, strengthens and weakens, but it's been a continuous background threat to personal computing since the first day something other than Microsoft tried to get traction in the industry.
reply
p_ing
1 hour ago
[-]
What does this even mean? It's like throwing around the word 'bloat'.
reply
BigTTYGothGF
2 hours ago
[-]
Looking at the rest of the tech industry in 2026 that might be a blessing.
reply
giancarlostoro
1 hour ago
[-]
Outside of work, I don't use Windows very often if at all. I have a 2017 laptop that Microsoft made, and it is so damn sluggish for absolutely no reason, its VERY VERY vanilla mind you.
reply
leptons
1 hour ago
[-]
Apple also holds back the tech industry in many ways. All companies seem willing to put profits before progress.
reply
red-iron-pine
53 minutes ago
[-]
active directory and excel runs the world.

what is apple doing that is similar?

reply
trueno
2 hours ago
[-]
i remember years and years ago learning some posix/shell syntax and working in terminal. felt like my love for windows unraveled in real time. these days using windows... feel like i gotta take a shower after. like many i was just raised on windows it was the household operating system i had like 20 years of general computer usage under my belt on windows before i finally felt a mac trackpad for the first time. that hardware experience alone was the first pillar kicked out upholding my "windows is the best" philosophies. then i got into coding, then i tripped and fell out of hourly boeing slave labor into a sql job (lost 55% yearly income, no regrets yo). then i started discovering the open source world, and learned just how much computing goes on outside of the world of windows and how many insanely bright minds are out there contributing to... not microsoft. now i have linux and macos machines everywhere, i still haven't found the bottom but the last 6-7 years or so have been a really rich journey.

currently have a 32bit win xp env spun up in 86box just to compile a project in some omega old visual studio dotnet 7 and the service pack update at the time (don't ask). it is seriously _wild_ being in there, feels like stepping into a time machine. nostalgia aside, the OS is for the most part... quiet. doesn't bother you, everything is kind of exactly where you expect it to be, no noise in my start menu, there isnt some omega bing network callstack in my explorer, no prompts to o365 my life up.

it feels kinda sad, what an era that was. it's just more annoying to do any meaningful work in windows these days.

im currently working with c/cpp the idiot way (nothing about my story is ever conventional sigh), by picking a legacy project from like 22 years ago. this has forced me to step back into old redhat 7.1+icc5, old windows xp + dotnet7 like i explained above, and im definitely taking the most unpragmatic approach ever diving in here.. but there's one thing that absolutely sticks out to me: microsoft has always tried to capitalize on everything. tool? money. vendor lock. os? money. vendor lock. entire industries/education system capture? lotta money. lotta vendor lock. lotta generational knowledge lock.

they are lucky people are still using github. theyve tried to poke the bear a few times and theyre slowly but surely enshittifying the place, but im just kinda losing any reverence for microsoft altogether. microsoft has been big for a hot minute now, they have their eras. you can feel when things are driven by smart visionary engineers working behind the scenes, and you can tell when things are in pure slop mode microservice get rich or die trying mode. yea, microsoft has.. always been vendor-lock aggro and kinda hostile, but the current era microsoft is by far the grossest it's ever been. see: microsoft teams (inb4 "i use teams every day, i dont have a problem with it")

im aware people smarter than me can write diatribes on why windows is the best at x thing, but im only informed by my own experience of having to use all three (linux/macos/windows) for my professional work life: i grew up thinking windows was the best.. now im like mostly confident that windows is actually the worst lol. by a pretty damn decent margin. i was gaslit for ages

reply
philistine
1 hour ago
[-]
> feel like i gotta take a shower after

I run Crossover and I feel like I gotta take a shower after. Just knowing there's a folder called drive_c on my Mac is the stuff of nightmares.

reply
shevy-java
1 hour ago
[-]
Yeah. I felt in a similar manner when I moved to Linux. Microsoft seemed to make people dumber. I do actually use both Linux and Windows (Win10 only), largely for testing various things, including java-related software. But every time I use Windows, I am annoyed at how slow everything is compared to Linux. (I should mention that I compile almost everything from source on Linux, so most of the default Linux stack I don't use; many linux distributions also suck by default, so I have to uncripple the software stack. I also use versioned appdirs similar as to how GoboLinux does, but in a more free form.)
reply
TheOtherHobbes
55 minutes ago
[-]
Microsoft has spent most of its life as a corporate bureaucracy that produces sales-and-marketing content, some of which happens to moonlight as software.
reply
dns_snek
1 hour ago
[-]
This is precisely why we can't allow platform-owners to be the arbiters of what software is allowed to run on our devices. Any software signing that is deemed to be crucial for ensuring grandma-safety needs to be delegated to independent third parties without perverse incentives.

This is what the Digital Markets Act is supposed to protect developers against. Have there been any news regarding EU's investigation into Apple? Last I remember they were still reviewing their signing & fee-collection scheme.

reply
nubinetwork
3 hours ago
[-]
reply
Tempest1981
1 hour ago
[-]
Thanks, the previous title was easy to miss: "Veracrypt project update"
reply
Lihh27
3 hours ago
[-]
heh the same company that controls your secure boot chain just killed the signing account for the tool that encrypts your disk
reply
onehair
1 hour ago
[-]
They should have also picked up that WireGuard Creator account also got his account terminated
reply
tsujamin
1 hour ago
[-]
They did, just further into the article:

> According to a post on Hacker News, the popular VPN client WireGuard is facing the same issue.

reply
onehair
1 hour ago
[-]
I meant to say, in the title. As Wireguard is way more popular than VeraCrypt...
reply
saltamimi
32 minutes ago
[-]
I'm confused why they can't just generate their own signing key and deploy it alongside the installer.

Using arbiter platforms like this sounds like a great way to footgun yourself.

reply
avipars
1 hour ago
[-]
reply
shevy-java
1 hour ago
[-]
Microsoft wants to control computers. This is why they came up with InsecureBoot - or ad-hoc eliminating accounts willy-nilly style. Microsoft kind of acts like Google here. It is also interesting that the US government is doing absolutely nothing against this despicable behaviour.
reply
red-iron-pine
37 minutes ago
[-]
the US government is owned by corporate interests and has been in some capacity since inception. special mention to the Russians and Israelis and Saudis who also own a piece.
reply
msla
3 hours ago
[-]
With Windows, you get what you pay for.

In this case, that's an OS controlled by an unaccountable company that can take application software away from you.

Related: If you're the customer, you're the product.

reply
subscribed
3 hours ago
[-]
Hmmm, so basically Google but you also pay for it?
reply
kgwxd
2 hours ago
[-]
ChromeOS and Android are definitely comparable.
reply
Already__Taken
3 hours ago
[-]
Windows actually isn't very cheap.
reply
stronglikedan
1 hour ago
[-]
agree, because "free" can be neither "cheap" nor "expensive"
reply
jonathanstrange
1 hour ago
[-]
It's not free at all. If you buy Windows through the official channels it's quite expensive. If you buy it on the grey market, it's dirt cheap, though.
reply
panzi
3 hours ago
[-]
I see what you did there.
reply
dark-star
3 hours ago
[-]
you can always either disable secureboot and driver signature verification, or (the better solution) just enroll your own certificate in your TPM and sign the driver with that...
reply
askonomm
2 hours ago
[-]
Ah, yes, the [insert super inconvenient and complex thing to do that most people don’t know, want or should do] will solve it! And when that fails, surely the user can just write their own OS, right? Bunch of skill-issued complainers we the users are.
reply
falcor84
1 hour ago
[-]
Well, the hope was always that those of us inconvenienced by M$ would all collectively contribute to making Linux distros more convenient for everyone. But we can't ever seem to get inconvenienced enough to actually sufficiently mobilize and/or coordinate such an effort.
reply
weaksauce
1 hour ago
[-]
It does seem like linux is having its moment right now. there's the money and effort valve is putting into KDE making the steamdeck and steammachine polished for their hardware which helps all users of KDE. cachyos is making having a rolling distro really smooth and snappy on old hardware and making games work mostly ootb. stuff like winboat and wine will let you use the few windows apps you need. you are kinda stuck though if you want to use something like fusion360 or solidworks. freecad has improved quite a bit but it's still like gimp where it's slightly worse UX in a lot of ways.
reply
dark-star
1 hour ago
[-]
I mean, the super-easy option would be to just use BitLocker for FDE. No hassles, just works. But I fugured since everyone here on HN hates MS I wouldn't even bring that up. Don't trust MS? Enroll yourown keys
reply
rstat1
18 minutes ago
[-]
Yes use Bitlocker, the thing that uploads the encryption key to OneDrive "for convenience" thereby negating the whole point of FDE in the first place
reply
malfist
3 hours ago
[-]
> or (the better solution) just enroll your own certificate in your TPM and sign the driver with that...

I'll tell Grandma that's what she needs to do.

reply
pixel_popping
2 hours ago
[-]
Make sure that she setup a PKI infrastructure to manage certificate revocation as well, wouldn't want a bad grandson to mess with it.
reply
p_ing
1 hour ago
[-]
Why would you put Grandma on VeriCrypt in the first place? It's the more 'difficult' option for FDE.
reply
unethical_ban
22 minutes ago
[-]
What's easier, and bitlocker doesn't count. I want my FDE to be based on a password or a keyfile, not simply by some code in the motherboard. I want it encrypted until I, the operator, provide some data to unlock.

In my limited experience with bitlocker, the disk is decryptable automatically as long as it's in the original motherboard.

reply
p_ing
17 minutes ago
[-]
> and bitlocker doesn't count.

Wat? Bitlocker is the answer to your question.

> In my limited experience with bitlocker, the disk is decryptable automatically as long as it's in the original motherboard.

It's unlocked (not decrypted) when the OS boots, yes. You can optionally enforce (not on Home) other unlock methods, such as PIN before the OS boots.

> I want my FDE to be based on a password or a keyfile, not simply by some code in the motherboard.

That's less secure than TPM.

reply
unethical_ban
1 minute ago
[-]
If someone steals my laptop, and there is no factor of decryption requiring something I possess or know, then the only use of that disk being encrypted is that I can throw it out more safely at end of life. Thieves/LEO has the data because they have the motherboard.

If bitlocker has a PIN/passphrase decrypt option, then I missed it.

reply
dark-star
1 hour ago
[-]
your grandma is probably fine with BitLocker....
reply
ntoskrnl_exe
2 hours ago
[-]
And they say Linux is inconvenient because you have to open the terminal every once in a while.
reply
ChrisArchitect
2 hours ago
[-]
reply