Tell HN: Google Cloud lets anyone add you to a project without your permission

Recently, a company in Kenya (which I have never heard or nor have any association with) added me to their Google Cloud project without my permission. At first, I thought I had mistakenly accepted an invite to their project. However, I swore that wasn’t the case. To test my theory, I tried creating an empty project and invited my other Google account to it. I discovered that Google Cloud lets you add ANY individual or company email (even at companies you aren't affiliated with) to a project without getting their permission or notifying them. Google doesn’t even send an email asking you to accept the invitation. It just adds you automatically without telling you. The end result is you can quite literally just type in any Google Cloud account (including accounts at companies you don't work at) and associate it with your project without them ever knowing.

The worst part is that you can’t leave the project after you’re added. Google requires the project owner remove you. They provide no way to remove yourself. I’ve tried contacting the company that added me but they’ve not responded to my requests.

I also tried contacting Google support and they’ve been less than helpful. At first, they thought that my account was hacked. I pointed out that this was not due to a hack, but due to Google’s faulty invite system. They responded back and said they didn’t see any association between my email and the project. So they listed the case as resolved and said they couldn’t discuss any further details about the project. This is despite the fact the unwanted project still appears on my GCP dashboard. I suspect they didn’t see any association because they were just checking the projects owned by my account and not checking projects I’ve been added to.

This whole situation seems like a recipe for unwanted spam since you can be added to projects without permission and can’t ever remove yourself. My biggest fear is if that company uses the project to do something malicious then my account might be banned by association. This could also be used in other ways. E.G. you could flood a competing startup's cloud dashboard with hundreds of bogus projects. You could even use it to get someone in trouble by adding them to a project that's doing illegal stuff (e.g. hosting illegal content). If this was limited to adding people within your GCP/GSuite this would be a minor issue because I doubt your coworker is going to use GCP to spam you / get you in trouble. However, the ability to add anyone and everyone outside of your GCP/GSuite makes this a huge issue in terms of spam / safety. Overall, this is a major oversight on Google’s side and is a huge security, privacy, and spam risk.

To date, I’ve still been unable to get any help from Google to resolve this issue. If there’s any Googlers willing to help, I would be extremely grateful.

That’s a great idea. I’ll try reporting it on their bug bounty

Edit: Reported it

Future HN post: Can being added to a project be defamatory?

(Maximum fun when you sue your own employer.)

Google in general has become far more loose on spam, from spam emails now showing on my Google calendar, to being added to projects where I cannot remove myself. They open up quite a lot of security holes and seem not be taking it seriously at all. I feel like this year for me has been some of the worst in a while. The amount of stuff I report everyday is considerable. I've been added to other drives in the past just you and I'm trying to find out how to move away from Google because of this issue. They are too big to care, but I've seen other platforms open up unfortunately it's hard to get away from the convenience of Google. Personally I think if you can move your stuff and create a backup account somewhere else it's probably a good idea too.