Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google Cloud lets anyone add you to a project without your permission

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 130 posts

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#31

Post by gpm »

015a wrote: post #6
thesuperbigfrog wrote: post #2

Idea: (never used Google Cloud, no idea of possible impediments) 1. Create throwaway account 2. Create throwaway project using throwaway account 3. Find emails of possible Googlers using public bug tracker 4. Add Googlers' emails to throwaway project 5. Post messages to throwaway project describing the problem 6. Hopefully Googlers understand the issue and can forward the issue to get it resolved

Idea: 1. Create a throwaway account. 2. Add a bunch of professional developers' at big companies email addresses to the account. Just shoot in the dark: johnanderson@google.com, mikejohnson@airbnb.com, wandamaximov@apple.com, throw in a couple common email aliases as well like developers@twitter.com or mobileteam@airbnb.com 3. Publish a bunch of apps to the play store which clearly breaks their app store policies 4.…

I'm sure this isn't a serious suggestion anyways... but if you were going to be malicious like this you ought to not include google.com accounts. They're likely treated differently.

Also, harvesting actual emails from github is really easy.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#33

Post by Ephil012 »

judge2020 wrote: post #30
Ephil012 wrote: post #15

Earlier quoted context omitted.

The issue is different from this. Allowing someone within a company to access a resource without asking them is not as big of a deal. The issue here is people outside your company can add you to projects without consent. Imagine you're a malicious actor and want to spam some company's Google Cloud Dashboard. You could just create a 100 different projects and add the company's users to those projects automatically, ev…

> The issue here is people outside your company can add you to projects without consent. Same for AWS, granting an identity in another account access to resources in your own AWS project also requires no approval on the other side. The issue you seem to have with Google is that it's verbose about showing everything you have access to. As for the company scenario, this is effectively not an issue for Google Workspace-…

I saw another comment which said this wasn't quite the case. https://news.ycombinator.com/item?id=34193624

Even if it is the case, it is still an issue because it can be used for abuse. If you wanted to pin abuse on someone you just need to add them to the project doing something illegal. Google tends to be trigger happy about banning so it could affect someone. I bet there are avenues for companies to deal with a situation like this, but it still affects individuals which is a big problem. Especially if your personal account gets banned.

I'd also argue that it's a spam issue for companies (albeit less than it is for individuals). You may not see it by default for companies, but it will still appear in some lists throughout the UI probably.

I think honestly both AWS / GCP should ask for permission to be invited when you're adding someone outside your company.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#34

Post by xyzzy_plugh »

thesuperbigfrog wrote: post #2

Idea: (never used Google Cloud, no idea of possible impediments) 1. Create throwaway account 2. Create throwaway project using throwaway account 3. Find emails of possible Googlers using public bug tracker 4. Add Googlers' emails to throwaway project 5. Post messages to throwaway project describing the problem 6. Hopefully Googlers understand the issue and can forward the issue to get it resolved

You joke but this won't actually work as the GCP dashboard is already useless for Googlers as it often doesn't even load due to the sheer volume of projects.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#37

Post by bushbaba »

lopatin wrote: post #19

My experience with AWS support is that they ask you if your issue has been resolved, and then let you close the ticket. But it sounds like GCP just closes the ticket for you if the support guy think it's not an issue, even if you disagree, there's no conversation to be had?

AWS will auto close a ticket after no response / activity for multiple weeks. That’s only after many, many warnings.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#39

Post by EarthLaunch »

A company without customer support is incentivizing everyone to blare every single problem to the largest possible audience. The overall impression is that the company's products are unpleasant and dysfunctional. It's the opposite of advertising. Is not having support really worth the damage this causes to a brand?

That said, many people treat support so badly that offering it may be worth avoiding on principle.

Post reply on HN