A Suggestion for Security Instructions

[shifujun]

I suggest that it be clearly stated in a prominent position: For the HWID activation method, you can install the system on another hard drive, allow the script to activate the system, and then return to the original hard drive's system, which will automatically activate. This indicates that the script does not make any physical changes to the system.

Because I believe many people, like me, have not been exposed to new activation methods for many years. It is difficult to determine whether the solutions found online are safe at first. If it were initially understood that changing the hard drive for activation is feasible, all doubts would definitely be dispelled.

I have seen some discussions in issues about whether the script introduces some problems to the system. If they used the hard drive swap activation method, the script would not have been executed on the existing system at all, and such concerns would not exist.

Thank you to the authors for developing this script.

[thecatontheceiling]

https://massgrave.dev/hwid

"This activation method does not store or modify any files in your system."

"This activation method gives you permanent Windows activation for your system hardware."

"All activations can be linked to a Microsoft account without any issues."

"Once the system is activated, this activation cannot be removed because the license is stored in the Microsoft servers and not in the user's system."

[shifujun]

Yes, I have read these sentences before. However, these sentences are merely a claim, and there is not enough evidence to prove that it actually does what it says. All I believe highlights that users can activate the system on another hard drive is very compelling evidence. This is the so-called cleanest activation method. It's just as secure as phone activation.

[thecatontheceiling]

What do you mean evidence? Do you want us to record a video of someone clean reinstalling windows and then it still being activated after?

And doing what you suggested would still be just writing text on a website (which would still not be evidence - just a claim).

If people really want to see if these claims are true or not, they should get a VM running.

[shifujun]

There is no need for a video. There is also no need to provide any evidence.It is only necessary to directly advise users not to execute any code in the current system.Even if the user obtains a script that has been tampered with by someone else, as long as he knows not to execute the script on the current system, then it doesn't matter.

I suggest that others also activate on another hard drive. This can ensure that even if there are unexpected bugs in the script, it will not affect my newly installed system.

Anyway, this is just a suggestion.

[thecatontheceiling]

We already tell people to verify the code being ran is in fact unmodified:
https://massgrave.dev/

"The IRM command in PowerShell downloads a script from a specified URL, and the IEX command executes it."
"Always double-check the URL before executing the command and verify the source if manually downloading files."

If this is not enough for you, the script that gets run also does a hash check to make sure a modified script isn't being executed:
https://massgrave.dev/get.ps1 (look for the # Verify script integrity comment)

Even if all of the above wasn't true, we are not going to tell people to use the script on a separate hard drive just because "it could be malicious". Adding this suggestion to the website will needlessly worry potential users into believing the script isn't completely safe.

Everyone who has approached us with a similar concern gets redirected to the "manual activation" section in the website documentation instead, which requires no binaries made by MASSGRAVE to be run and doesn't require physically disconnecting hard drives:
https://massgrave.dev/hwid#1--from-ready-made-ticket

[shifujun]

I fully agree that such selfless work doesn't need to satisfy everyone. I also understand that suggestions don't necessarily have to be accepted. Feel free to close this discussion anytime.

[ave9858]

We already have the manual activation guide, which doesn't require you to run any MAS code at all. If someone thinks the script is malicious, they can just check the source code instead of running a potentially malicious script directly on their hardware, which could in theory try to tamper with the other drive, mess with the BIOS etc

[shifujun]

I think most users won't think too much. Maybe I'm just an exception, or I can only represent a small part of the people. We are lazy and unwilling to look closely at the manual guide.

We are also suspicious, fearing that scripts have bugs, which may cause hidden dangers to the newly installed system.

If we were not so suspicious, we would never come to find activation scripts by ourselves, and we could directly install third-party made install iso.

My suggestion is aimed at users like me who are both lazy and suspicious.😅

[ave9858]

Well, if you won't read the docs we can't really give any security advice cuz you won't read it 🤣

[shifujun]

However, a few lines in the README, like the current ones that say "open PowerShell and run the script", will still be read.

So I think it's a very convincing statement to tell users in one or two sentences that they can activate the current system without executing the script on the current system.

[WindowsAddict]

@shifujun Thanks for the suggestion but what you are suggesting is very overcomplicating, especially to those who aren't bothering to read docs at all which clearly states that activation persists after a clean install and there are very easy to follow manual methods as well.
Closing this here now.