<![CDATA[#Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal.]]> locks account that maintainer uses to sign bootloaders with no explanation or route for appeal. If they don't fix this, in a few months every Windows computer that uses VeraCrypt whole-disk encryption will stop being able to boot and all the data on it that isn't backed up elsewhere will be lost. 🤦
If this doesn't convince you big tech has too much control, I don't know what will.
h/t @zackwhittaker
https://techcrunch.com/2026/04/08/veracrypt-encryption-software-windows-microsoft-lock-boot-issues/

]]>https://board.circlewithadot.net/topic/9a90af40-56d7-46fa-91eb-57ef5c7a023d/microsoft-locks-account-that-veracrypt-maintainer-uses-to-sign-windows-bootloaders-with-no-explanation-or-route-for-appeal.RSS for NodeThu, 09 Apr 2026 12:18:27 GMTWed, 08 Apr 2026 15:44:36 GMT60<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 20:34:59 GMT]]>@jik @zackwhittaker big tech can eat a big dick

]]>https://board.circlewithadot.net/post/https://cyberplace.social/ap/users/115588296584761431/statuses/116370997194605453https://board.circlewithadot.net/post/https://cyberplace.social/ap/users/115588296584761431/statuses/116370997194605453Wed, 08 Apr 2026 20:34:59 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 18:39:13 GMT]]>@jik @zackwhittaker

]]>https://board.circlewithadot.net/post/https://mastodon.bsd.cafe/users/jaap/statuses/116370542028015131https://board.circlewithadot.net/post/https://mastodon.bsd.cafe/users/jaap/statuses/116370542028015131Wed, 08 Apr 2026 18:39:13 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 18:22:21 GMT]]>@jik @zackwhittaker what

Why would being unable to sign stuff stop you from booting and decrypting your disk "in a few months"

What did VeraCrypt do

Why do they even have M$ signing keys

Whay

]]>https://board.circlewithadot.net/post/https://mastodon.minionflo.net/ap/users/116346548544271763/statuses/116370475677302813https://board.circlewithadot.net/post/https://mastodon.minionflo.net/ap/users/116346548544271763/statuses/116370475677302813Wed, 08 Apr 2026 18:22:21 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 18:20:43 GMT]]>@jik@federate.social @zackwhittaker@mastodon.social depending on microslop has consequences tbh

]]>https://board.circlewithadot.net/post/https://mk.magicka.org/notes/aktxu79vkos5001khttps://board.circlewithadot.net/post/https://mk.magicka.org/notes/aktxu79vkos5001kWed, 08 Apr 2026 18:20:43 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:50:36 GMT]]>@gsuberland @diagprov @manawyrm @azonenberg @jik @zackwhittaker there are two types of revocation lists, the old one that can revoke certs and binaries by hash (two different lists for boot and drivers), and the new one that's just a CiPolicy and can therefore revoke by anything that a CiPolicy supports.]]>https://board.circlewithadot.net/post/https://labyrinth.zone/objects/baec1378-f1ab-4512-ad6b-0c1153e9f77fhttps://board.circlewithadot.net/post/https://labyrinth.zone/objects/baec1378-f1ab-4512-ad6b-0c1153e9f77fWed, 08 Apr 2026 17:50:36 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:47:08 GMT]]>@jik yeah, I just decided never to back up anywhere that wasn't a disk I owned...

]]>https://board.circlewithadot.net/post/https://jawns.club/users/acm_redfox/statuses/116370337193957203https://board.circlewithadot.net/post/https://jawns.club/users/acm_redfox/statuses/116370337193957203Wed, 08 Apr 2026 17:47:08 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:46:45 GMT]]>@gsuberland @manawyrm @azonenberg @jik @zackwhittaker me neither but given how closely uefi code looks to Microsoft C code I bet the mechanism of dbx is very similar to the kernel.

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/diagprov/statuses/116370335705099126https://board.circlewithadot.net/post/https://mathstodon.xyz/users/diagprov/statuses/116370335705099126Wed, 08 Apr 2026 17:46:45 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:43:15 GMT]]>@diagprov @manawyrm @azonenberg @jik @zackwhittaker yup that tracks with my understanding of it. Windows does have a driver cert revocation mechanism and a more general blocklist to prevent loading known-vulnerable drivers, but I haven't studied it in detail.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370321906871424https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370321906871424Wed, 08 Apr 2026 17:43:15 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:42:42 GMT]]>@gsuberland @manawyrm @azonenberg @jik @zackwhittaker they're blocked on signing new builds.

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/diagprov/statuses/116370319798086227https://board.circlewithadot.net/post/https://mathstodon.xyz/users/diagprov/statuses/116370319798086227Wed, 08 Apr 2026 17:42:42 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:41:32 GMT]]>@gsuberland @manawyrm @azonenberg @jik @zackwhittaker the certificates used to sign them do have an expiry but timestamps solve both expired cert and expired CA. The only way to revoke it is to add that cert to a CRL and leave it there permanently. I've no idea if the windows kernel checks crls or just maintains a list of blocked certs but I'd expect it to share the logic with windows and keep a cached crl (could be wrong, a long time since I cared much about windows drivers).

UEFI I don't think checks either expiry or timestamps at all. Instead it has the dbx which can contain blocked certificates or hashes of binaries that should not load.

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/diagprov/statuses/116370315214633239https://board.circlewithadot.net/post/https://mathstodon.xyz/users/diagprov/statuses/116370315214633239Wed, 08 Apr 2026 17:41:32 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:23:40 GMT]]>@jik @zackwhittaker
Encouraging the switch to a new Windows, a new PC, a new slop.
And reminding me I still have a VeraCrypt volume somewhere.

]]>https://board.circlewithadot.net/post/https://mastodon.gamedev.place/ap/users/116092650648397225/statuses/116370244943380303https://board.circlewithadot.net/post/https://mastodon.gamedev.place/ap/users/116092650648397225/statuses/116370244943380303Wed, 08 Apr 2026 17:23:40 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:09:49 GMT]]>@manawyrm @gsuberland @azonenberg @jik @zackwhittaker

Fair enough. I don't encourage just anyone either. Those who I have encouraged also know to call me if something blows up! 😂

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/jeffcodes/statuses/116370190480134624https://board.circlewithadot.net/post/https://infosec.exchange/users/jeffcodes/statuses/116370190480134624Wed, 08 Apr 2026 17:09:49 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:09:18 GMT]]>@jik @zackwhittaker

> If they don't fix this, in a few months every Windows computer that uses VeraCrypt whole-disk encryption will stop being able to boot and all the data on it that isn't backed up elsewhere will be lost. 🤦

uhmmm this seems like a pretty big design flaw. Imagine if on FreeBSD or Linux that your GELI / LUKS encryption stops working because some developer's computer was inaccessible....]]>https://board.circlewithadot.net/post/https://friedcheese.us/objects/6d52df05-8be6-4898-bcfd-af843e39bc39https://board.circlewithadot.net/post/https://friedcheese.us/objects/6d52df05-8be6-4898-bcfd-af843e39bc39Wed, 08 Apr 2026 17:09:18 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:08:05 GMT]]>@jeffcodes @gsuberland @azonenberg @jik @zackwhittaker You're absolutely right and will get no argument from me there. I have always supported people encrypting their drives and will give support to people trying to do that.

Still, VeraCrypt is just a very fragile piece of kit and users need to know that and be able to either fix it themselves or know someone who can do it.

Telling just random people on the streets to install it will indeed just block access to their data -- even without MS.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/manawyrm/statuses/116370183681044248https://board.circlewithadot.net/post/https://chaos.social/users/manawyrm/statuses/116370183681044248Wed, 08 Apr 2026 17:08:05 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:06:03 GMT]]>@manawyrm @gsuberland @azonenberg @jik @zackwhittaker

IMO, it is not acceptable to simply overlook these hurdles and say, "this is not available to you because you're not technical like me." These tools are necessary against the mass surveillance of the companies like Microsoft, Google, etc. and governments alike.
We, as technologist, should be working to make these more accessible to those who are not technologists too. Those folks deserve the right and privacy and security like the rest of us.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/jeffcodes/statuses/116370175665038226https://board.circlewithadot.net/post/https://infosec.exchange/users/jeffcodes/statuses/116370175665038226Wed, 08 Apr 2026 17:06:03 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:03:40 GMT]]>@azonenberg @gsuberland @jik @manawyrm @zackwhittaker that said. i wonder if this is MS attempting to do some form of moderation on driver / EFI signers, given the instances of game cheat devs and outright malware actors signing drivers in the past (do i need to cite that unknowncheats thread again?)

that said, I quickly browsed around unknowncheats and didn't see anyone complaining about this, so...]]>https://board.circlewithadot.net/post/https://labyrinth.zone/objects/1e51cca7-5a2d-4ae2-b767-6feea3c3aedahttps://board.circlewithadot.net/post/https://labyrinth.zone/objects/1e51cca7-5a2d-4ae2-b767-6feea3c3aedaWed, 08 Apr 2026 17:03:40 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:03:12 GMT]]>@jeffcodes @gsuberland @azonenberg @jik @zackwhittaker I'm very sorry, but users that aren't capable of getting help with recovering such data from someone that can handle a Linux Live ISO shouldn't be using VeraCrypt to begin with.
It's extremely likely to just cause your system to stop booting (and that has happened to me 5+ times in the years I was using it) -- it's just a regular occurance and you'll need to deal with these things as a user.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/manawyrm/statuses/116370164430367097https://board.circlewithadot.net/post/https://chaos.social/users/manawyrm/statuses/116370164430367097Wed, 08 Apr 2026 17:03:12 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 17:01:31 GMT]]>@manawyrm @gsuberland @azonenberg @jik @zackwhittaker

The data may be fine; however, not everyone who may use VeraCrypt has the same knowledge and skill base to know to pull up a Linux Live USB and go get their data back. I've encouraged non-technical users to use easy breakthroughs to add encryption to their Windows Home environments. They definitely will not have the knowledge do just go do this. Many may not have another device to create the Linux Live USB either.
This is still a problem, whether or not the data is still available through other means.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/jeffcodes/statuses/116370157848437458https://board.circlewithadot.net/post/https://infosec.exchange/users/jeffcodes/statuses/116370157848437458Wed, 08 Apr 2026 17:01:31 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 16:56:59 GMT]]>@manawyrm @azonenberg @jik @zackwhittaker (yes just checked and this is exactly how it works)

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370139990811153https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370139990811153Wed, 08 Apr 2026 16:56:59 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 16:56:41 GMT]]>@Rairii @manawyrm @jik @azonenberg @zackwhittaker yup exactly the way I thought it worked

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370138830131236https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370138830131236Wed, 08 Apr 2026 16:56:41 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 16:56:11 GMT]]>@manawyrm @azonenberg @jik @zackwhittaker fairly sure driver signatures don't have an expiry at all; it's only the CA that has an expiry and an expired CA doesn't invalidate an existing valid signature, as long as that signature's date was within the valid time range of the CA.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370136877592571https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370136877592571Wed, 08 Apr 2026 16:56:11 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 16:55:23 GMT]]>@gsuberland @azonenberg @jik @manawyrm @zackwhittaker (talking about at executable load time here)]]>https://board.circlewithadot.net/post/https://labyrinth.zone/objects/a5ddc2c9-03e6-47eb-9e81-a3158c053f13https://board.circlewithadot.net/post/https://labyrinth.zone/objects/a5ddc2c9-03e6-47eb-9e81-a3158c053f13Wed, 08 Apr 2026 16:55:23 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 16:54:55 GMT]]>@gsuberland @azonenberg @manawyrm @jik @zackwhittaker certificate expiry won't be enforced, however if outright revocation of binaries happen, that will be]]>https://board.circlewithadot.net/post/https://labyrinth.zone/objects/242b103c-1d4b-46a0-9f49-ddf8a3b1d376https://board.circlewithadot.net/post/https://labyrinth.zone/objects/242b103c-1d4b-46a0-9f49-ddf8a3b1d376Wed, 08 Apr 2026 16:54:55 GMT<![CDATA[Reply to #Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. on Wed, 08 Apr 2026 16:54:41 GMT]]>@azonenberg @manawyrm @jik @zackwhittaker yes, precisely

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370130938842420https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116370130938842420Wed, 08 Apr 2026 16:54:41 GMT