Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google Cloud lets anyone add you to a project without your permission

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 130 posts

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#15

Post by Ephil012 »

supriyo-biswas wrote: post #8

I am not even sure what all the fuss is about. AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This model is used because otherwise providing permissions becomes extremely difficult, and users are more likely to throw away the entire concept and settle for one common set of credentials for all users across the project (in the form of…

The issue is different from this. Allowing someone within a company to access a resource without asking them is not as big of a deal. The issue here is people outside your company can add you to projects without consent.

Imagine you're a malicious actor and want to spam some company's Google Cloud Dashboard. You could just create a 100 different projects and add the company's users to those projects automatically, even though you're not part of that company. Those projects can never be removed or deleted from the dashboard. So every user at the company you're trying to spam can never get rid of it (without Google support intervening maybe).

Or let's say you're a malicious actor trying to get someone in trouble. You could create a Google account and hide all traces of who created it. Then you could just create a project doing something illegal (e.g. hosting illegal content) and then add someone to the project. When the authorities find out about the project, the person you're targeting will get investigated for hosting illegal content.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#16

Post by Ephil012 »

dilyevsky wrote: post #13

Yes it’s relatively well known that gcp allows to assign random iam permissions to any service accounts, users and groups that exist within globally scoped gcp/gsuite domains with no way to restrict this by the recipients

Yeah, the big issue though is you can add people outside your company. Not just within your gsuite. Adding within the gsuite is not as big of the deal, but the ability to add anyone outside your company is a big issue because it enables mass spam

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#18

Post by eks391 »

softsound wrote: post #9

Google in general has become far more loose on spam, from spam emails now showing on my Google calendar, to being added to projects where I cannot remove myself. They open up quite a lot of security holes and seem not be taking it seriously at all. I feel like this year for me has been some of the worst in a while. The amount of stuff I report everyday is considerable. I've been added to other drives in the past just…

For personal stuff, it is daunting but degoogling is definitely sustainable. I have been unsuccessful getting every person to contact me on my new email no matter how many times I remind them though. There are great ecosystems out there for contacts, maps, storage, whatever, that don't rely on google, and if the spam bothers you, I recommend giving it a go for awhile to see. Change the email last though in case you decide not to make the change so you don't have to tell people twice to change their contact for you. For the people who don't change their contact for you, you can make a quick filter in gmail to forward mail from them to your new email, respond from that, and maybe they'll change your contact someday.

Also if you don't want to completely degoogle but just want to rid yourself of some of the spam, you can use services from other ecosystems, as part of a suite, and connect the email from that suite to a google account, so you can still use googles' services and the other suites' services. Then when randos add you to things like spam in your calendar, you won't actually see it because you are using a calendar from a different suite.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#19

Post by lopatin »

My experience with AWS support is that they ask you if your issue has been resolved, and then let you close the ticket.

But it sounds like GCP just closes the ticket for you if the support guy think it's not an issue, even if you disagree, there's no conversation to be had?

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#20

Post by iueotnmunto »

lopatin wrote: post #19

My experience with AWS support is that they ask you if your issue has been resolved, and then let you close the ticket. But it sounds like GCP just closes the ticket for you if the support guy think it's not an issue, even if you disagree, there's no conversation to be had?

TIL google had support tickets, I thought they largely didn't communicate with their client base
Post reply on HN