Remix.run Logo
Microsoft Abruptly Terminates VeraCrypt Account, Halting Windows Updates(404media.co)
165 points by donohoe 3 hours ago | 40 comments
romaniv 34 minutes ago | parent | next [-]

I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.

astrobe_ 26 minutes ago | parent [-]

I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.

tosti a minute ago | parent | next [-]

Computers should abide by their owners. Any computer not doing that is broken.

201984 19 minutes ago | parent | prev [-]

And what if that customer wants to run their own firmware, ie after the manufacturer goes out of business? "Security" in this case conveniently prevente that.

gjsman-1000 13 minutes ago | parent [-]

Tradeoffs. Which is more likely here?

1. A customer wants to run their own firmware, or

2. Someone malicious close to the customer, an angry ex, tampers with their device, and uses the lack of Secure Boot to modify the OS to hide all trace of a tracker's existence, or

3. A malicious piece of firmware uses the lack of Secure Boot to modify the boot partition to ensure the malware loads before the OS, thereby permanently disabling all ability for the system to repair itself from within itself

Apple uses #2 and #3 in their own arguments. If your Mac gets hacked, that's bad. If your iPhone gets hacked, that's your life, and your precise location, at all times.

samlinnfer 8 minutes ago | parent [-]

1. P(someone wants to run their own firmware)

2. P(someone wants to run their own firmware) * P(this person is malicious) * P(this person implants this firmware on someone else’s computer)

3. The firmware doesn’t install itself

Yeah I think 2 and 3 is vastly less likely and strictly lower than 1.

philistine 2 minutes ago | parent | next [-]

As if the monetary gain of 2 and 3 never entered the picture. Malicious actors want 2 and 3 to make money off you! No one can make reasonable amounts of money off 1.

gjsman-1000 6 minutes ago | parent | prev [-]

On Android, according to the Coalition Against Stalkerware, there are over 1 million victims of deliberately placed spyware on an unlocked device by a malicious user close to the victim every year.

#2 is WAY more likely than #1. And that's on Android which still has some protections even with a sideloaded APK (deeply nested, but still detectable if you look at the right settings panels).

As for #3; the point is that it's a virus. You start with a webkit bug, you get into kernel from there (sometimes happens); but this time, instead of a software update fixing it, your device is owned forever.

samlinnfer 4 minutes ago | parent [-]

And where are the stats for people running their own firmware and are not running stalkerware for comparison? You don’t need firmware access to install malware on Android, so how many of stalkerware victims actually would have been saved by a locked bootloader?

gjsman-1000 3 minutes ago | parent [-]

The entirety of GrapheneOS is about 200K downloads per update. Malicious use therefore is roughly 5-1.

20k an hour ago | parent | prev | next [-]

There's a good reason everyone calls them microslop these days. The sooner we're all able to ditch this crappy company, the better - they're actively holding back the tech industry at this point

mbix77 29 minutes ago | parent | next [-]

Yea, I'm in the process of converting our complete ETL infrastructure from SSIS/SQL Server to Python/PostgreSQL. Next step is Office 365, which will be more difficult, but doable since we are a small company anyway.

stvltvs 25 minutes ago | parent [-]

Are you converting the SSIS automatically somehow or rewriting it?

giancarlostoro 23 minutes ago | parent | prev | next [-]

Outside of work, I don't use Windows very often if at all. I have a 2017 laptop that Microsoft made, and it is so damn sluggish for absolutely no reason, its VERY VERY vanilla mind you.

tonyedgecombe an hour ago | parent | prev | next [-]

They have been holding back the tech industry for decades now.

p_ing 7 minutes ago | parent | next [-]

What does this even mean? It's like throwing around the word 'bloat'.

embedding-shape 36 minutes ago | parent | prev | next [-]

To be fair, the tech industry been holding itself back for decades now too, since lots of people seemingly have somewhat low prices to go from being a FOSS evangelist to wearing a "Microsoft <3 Open Source" t-shirt.

trueno 12 minutes ago | parent [-]

that's just a byproduct of "job creators" holding the keys to a comfortable life over everyones head.

i dont think its fair to conflate the tech industries self-owns with microsofts damages. microsoft has for decades poured untold resources and money into capturing everything they possibly could to sustain themselves with honestly what i call cultural and software vendor lock. we're only just now seeing the gaming industry take its first real footsteps towards non-windows targets, but for the most part the decades of evangelizing Microsoft apis and bankrolling schools and education systems to carry courses for their way of doing things makes that a particularly uphill battle thats going to take a lot more time. people have built entire careers out of the microsoft-way in multiple industries. pure microsoft houses are still everywhere at many orgs, so many of them don't even recognize that there is another path. there's plenty of infra/dbadmin/devops people who are just pure windows still. there's multiple points where microsoft did have the best in class solution for something, but these days you'd be hard pressed to not go another way if you were starting from scratch. problem is such a lift and shift is really hard to do for orgs that have spent decades being a microsoft shop.

in a roundabout way, this sort of translates to real long lasting impact/damage to me. microsoft has always been such a force over history that it caused a massive rift in computing. no matter how much they embrace linux and claim to not fight the uphill battle of open source anymore, that modus operandi of locking people into their suite of things still exists on so many fronts and is in some ways more in your face than it's ever been. there's no benefit of the doubt to give here, i just have a hard time choosing microsoft for... well anything.

BigTTYGothGF 31 minutes ago | parent | prev [-]

Looking at the rest of the tech industry in 2026 that might be a blessing.

trueno an hour ago | parent | prev [-]

i remember years and years ago learning some posix/shell syntax and working in terminal. felt like my love for windows unraveled in real time. these days using windows... feel like i gotta take a shower after. like many i was just raised on windows it was the household operating system i had like 20 years of general computer usage under my belt on windows before i finally felt a mac trackpad for the first time. that hardware experience alone was the first pillar kicked out upholding my "windows is the best" philosophies. then i got into coding, then i tripped and fell out of hourly boeing slave labor into a sql job (lost 55% yearly income, no regrets yo). then i started discovering the open source world, and learned just how much computing goes on outside of the world of windows and how many insanely bright minds are out there contributing to... not microsoft. now i have linux and macos machines everywhere, i still haven't found the bottom but the last 6-7 years or so have been a really rich journey.

currently have a 32bit win xp env spun up in 86box just to compile a project in some omega old visual studio dotnet 7 and the service pack update at the time (don't ask). it is seriously _wild_ being in there, feels like stepping into a time machine. nostalgia aside, the OS is for the most part... quiet. doesn't bother you, everything is kind of exactly where you expect it to be, no noise in my start menu, there isnt some omega bing network callstack in my explorer, no prompts to o365 my life up.

it feels kinda sad, what an era that was. it's just more annoying to do any meaningful work in windows these days.

im currently working with c/cpp the idiot way (nothing about my story is ever conventional sigh), by picking a legacy project from like 22 years ago. this has forced me to step back into old redhat 7.1+icc5, old windows xp + dotnet7 like i explained above, and im definitely taking the most unpragmatic approach ever diving in here.. but there's one thing that absolutely sticks out to me: microsoft has always tried to capitalize on everything. tool? money. vendor lock. os? money. vendor lock. entire industries/education system capture? lotta money. lotta vendor lock. lotta generational knowledge lock.

they are lucky people are still using github. theyve tried to poke the bear a few times and theyre slowly but surely enshittifying the place, but im just kinda losing any reverence for microsoft altogether. microsoft has been big for a hot minute now, they have their eras. you can feel when things are driven by smart visionary engineers working behind the scenes, and you can tell when things are in pure slop mode microservice get rich or die trying mode. yea, microsoft has.. always been vendor-lock aggro and kinda hostile, but the current era microsoft is by far the grossest it's ever been. see: microsoft teams (inb4 "i use teams every day, i dont have a problem with it")

nubinetwork 2 hours ago | parent | prev | next [-]

https://news.ycombinator.com/item?id=47686549

Tempest1981 19 minutes ago | parent [-]

Thanks, the previous title was easy to miss: "Veracrypt project update"

onehair 22 minutes ago | parent | prev | next [-]

They should have also picked up that WireGuard Creator account also got his account terminated

tsujamin 13 minutes ago | parent [-]

They did, just further into the article:

> According to a post on Hacker News, the popular VPN client WireGuard is facing the same issue.

onehair a few seconds ago | parent [-]

I meant to say, in the title. As Wireguard is way more popular than VeraCrypt...

Lihh27 an hour ago | parent | prev | next [-]

heh the same company that controls your secure boot chain just killed the signing account for the tool that encrypts your disk

shevy-java a minute ago | parent | prev | next [-]

Microsoft wants to control computers. This is why they came up with InsecureBoot - or ad-hoc eliminating accounts willy-nilly style. Microsoft kind of acts like Google here. It is also interesting that the US government is doing absolutely nothing against this despicable behaviour.

msla 2 hours ago | parent | prev | next [-]

With Windows, you get what you pay for.

In this case, that's an OS controlled by an unaccountable company that can take application software away from you.

Related: If you're the customer, you're the product.

subscribed 2 hours ago | parent | next [-]

Hmmm, so basically Google but you also pay for it?

kgwxd 41 minutes ago | parent [-]

ChromeOS and Android are definitely comparable.

Already__Taken 2 hours ago | parent | prev | next [-]

Windows actually isn't very cheap.

panzi 2 hours ago | parent | prev | next [-]

I see what you did there.

dark-star 2 hours ago | parent | prev [-]

you can always either disable secureboot and driver signature verification, or (the better solution) just enroll your own certificate in your TPM and sign the driver with that...

askonomm an hour ago | parent | next [-]

Ah, yes, the [insert super inconvenient and complex thing to do that most people don’t know, want or should do] will solve it! And when that fails, surely the user can just write their own OS, right? Bunch of skill-issued complainers we the users are.

falcor84 25 minutes ago | parent [-]

Well, the hope was always that those of us inconvenienced by M$ would all collectively contribute to making Linux distros more convenient for everyone. But we can't ever seem to get inconvenienced enough to actually sufficiently mobilize and/or coordinate such an effort.

malfist 2 hours ago | parent | prev | next [-]

> or (the better solution) just enroll your own certificate in your TPM and sign the driver with that...

I'll tell Grandma that's what she needs to do.

p_ing 6 minutes ago | parent | next [-]

Why would you put Grandma on VeriCrypt in the first place? It's the more 'difficult' option for FDE.

pixel_popping an hour ago | parent | prev [-]

Make sure that she setup a PKI infrastructure to manage certificate revocation as well, wouldn't want a bad grandson to mess with it.

ntoskrnl_exe an hour ago | parent | prev [-]

And they say Linux is inconvenient because you have to open the terminal every once in a while.

ChrisArchitect an hour ago | parent | prev [-]

[dupe] https://news.ycombinator.com/item?id=47686549