Post B55anra59Lz3ugBpqK by jik@federate.social
(DIR) More posts by jik@federate.social
(DIR) Post #B55anra59Lz3ugBpqK by jik@federate.social
1 likes, 5 repeats
#Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. If they don't fix this, in a few months every Windows computer that uses VeraCrypt whole-disk encryption will stop being able to boot and all the data on it that isn't backed up elsewhere will be lost. 🤦If this doesn't convince you big tech has too much control, I don't know what will.h/t @zackwhittakerhttps://techcrunch.com/2026/04/08/veracrypt-encryption-software-windows-microsoft-lock-boot-issues/#infosec #privacy #TechIsShitDispatch
(DIR) Post #B55ansGGcVjC1VvWb2 by jik@federate.social
0 likes, 1 repeats
If you use #VeraCrypt full-disk encryption on #Windows, then READ THE ABOVE ARTICLE and pay attention to this developing story. If it hasn't been resolved in the next month or so then you are going to want to disable VeraCrypt on your computer to avoid being permanently locked out of your own computer when the VeraCrypt bootloader signing certificates expire and the maintainer isn't able to renew them.#PSA
(DIR) Post #B55dkBre5wfjWbLTbk by manawyrm@chaos.social
0 likes, 0 repeats
@jik @zackwhittaker Weeeelll, that's a bit too much panic! Yes, the machines might not boot anymore, but the data is still there. It can still be read on a normal Linux Live-ISO just fine.
(DIR) Post #B55dkCF2gxO4hAIA4m by azonenberg@ioc.exchange
0 likes, 0 repeats
@manawyrm @jik @zackwhittaker wait, so if the certificate expires *existing signed binaries* will no longer run? Does this mean any signed bootloader has an inherent shelf life and will need to be re-signed every so many years even if no changes are being made to it?
(DIR) Post #B55dmWOwi2s5na26VM by azonenberg@ioc.exchange
0 likes, 0 repeats
@manawyrm @jik @zackwhittaker or is it that the cert will be explicitly revoked rather than expired? the article is a bit unclear on this
(DIR) Post #B55donYNuPCXZgX8IC by gsuberland@chaos.social
0 likes, 0 repeats
@azonenberg @manawyrm @jik @zackwhittaker afaik no. the expiry usually isn't enforced.
(DIR) Post #B55dtRkkOGDNPQX4Xw by azonenberg@ioc.exchange
0 likes, 0 repeats
@gsuberland @manawyrm @jik @zackwhittaker Usually the way cert expiration for signing works is signatures are timestamped by a third party and any signature *made* post expiry is not trusted, but old ones are valid in perpetuity as long as the cert had been valid when the signature was created
(DIR) Post #B55dx6VhJQ3WgUEl6W by gsuberland@chaos.social
0 likes, 0 repeats
@azonenberg @manawyrm @jik @zackwhittaker yes, precisely
(DIR) Post #B55dyOF8roLbyJ6fPE by Rairii@labyrinth.zone
0 likes, 0 repeats
@gsuberland @azonenberg @manawyrm @jik @zackwhittaker certificate expiry won't be enforced, however if outright revocation of binaries happen, that will be
(DIR) Post #B55e0fB6sFtz4dIwCG by Rairii@labyrinth.zone
0 likes, 0 repeats
@gsuberland @azonenberg @jik @manawyrm @zackwhittaker (talking about at executable load time here)
(DIR) Post #B55ektdvQVsXFwpQ0m by Rairii@labyrinth.zone
0 likes, 0 repeats
@azonenberg @gsuberland @jik @manawyrm @zackwhittaker that said. i wonder if this is MS attempting to do some form of moderation on driver / EFI signers, given the instances of game cheat devs and outright malware actors signing drivers in the past (do i need to cite that unknowncheats thread again?)that said, I quickly browsed around unknowncheats and didn't see anyone complaining about this, so...
(DIR) Post #B55iwS8ptyBnFn3KK0 by manawyrm@chaos.social
0 likes, 0 repeats
@gsuberland @azonenberg @jik @zackwhittaker that's what I would've expected as well, but I'm not 100% sure about how Windows driver signing works.Either way, the data is perfectly fine :)
(DIR) Post #B55iwSKXCTXxq4WfYW by gsuberland@chaos.social
0 likes, 0 repeats
@manawyrm @azonenberg @jik @zackwhittaker fairly sure driver signatures don't have an expiry at all; it's only the CA that has an expiry and an expired CA doesn't invalidate an existing valid signature, as long as that signature's date was within the valid time range of the CA.
(DIR) Post #B55iwSYMN4bcWwzi6a by gsuberland@chaos.social
0 likes, 0 repeats
@manawyrm @azonenberg @jik @zackwhittaker (yes just checked and this is exactly how it works)
(DIR) Post #B55iwSnxR55BJKIAPw by diagprov@mathstodon.xyz
0 likes, 0 repeats
@gsuberland @manawyrm @azonenberg @jik @zackwhittaker the certificates used to sign them do have an expiry but timestamps solve both expired cert and expired CA. The only way to revoke it is to add that cert to a CRL and leave it there permanently. I've no idea if the windows kernel checks crls or just maintains a list of blocked certs but I'd expect it to share the logic with windows and keep a cached crl (could be wrong, a long time since I cared much about windows drivers).UEFI I don't think checks either expiry or timestamps at all. Instead it has the dbx which can contain blocked certificates or hashes of binaries that should not load.
(DIR) Post #B55iwT2UZ2i02P5m4W by gsuberland@chaos.social
0 likes, 0 repeats
@diagprov @manawyrm @azonenberg @jik @zackwhittaker yup that tracks with my understanding of it. Windows does have a driver cert revocation mechanism and a more general blocklist to prevent loading known-vulnerable drivers, but I haven't studied it in detail.
(DIR) Post #B55iwTEtoudKestgPY by Rairii@labyrinth.zone
0 likes, 0 repeats
@gsuberland @diagprov @manawyrm @azonenberg @jik @zackwhittaker there are two types of revocation lists, the old one that can revoke certs and binaries by hash (two different lists for boot and drivers), and the new one that's just a CiPolicy and can therefore revoke by anything that a CiPolicy supports.
(DIR) Post #B55iwTbETsUvm9LWDo by diagprov@mathstodon.xyz
0 likes, 0 repeats
@gsuberland @manawyrm @azonenberg @jik @zackwhittaker they're blocked on signing new builds.