Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google Cloud lets anyone add you to a project without your permission

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 130 posts

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#41

Post by Ephil012 »

iueotnmunto wrote: post #20
lopatin wrote: post #19

My experience with AWS support is that they ask you if your issue has been resolved, and then let you close the ticket. But it sounds like GCP just closes the ticket for you if the support guy think it's not an issue, even if you disagree, there's no conversation to be had?

TIL google had support tickets, I thought they largely didn't communicate with their client base

They don't except for certain products. Google Cloud has a paid support plan. The free tier only lets you file tickets for billing issues. I ended up just filing this ticket as a billing ticket even though it's really not

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#42

Post by Ephil012 »

lopatin wrote: post #19

My experience with AWS support is that they ask you if your issue has been resolved, and then let you close the ticket. But it sounds like GCP just closes the ticket for you if the support guy think it's not an issue, even if you disagree, there's no conversation to be had?

The guy said the ticket was resolved multiple times, but then I just responded again. He'd respond back with some unhelpful answer then say at the end "this issue is resolved"

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#43

Post by killingtime74 »

totaldude87 wrote: post #22

I never had a good time with google Support ( not just gcp) One time I sent a trade in device which usps confirmed as delivered to google , google store said that it was just an empty box and no phone was inside … After fighting tooth and nail , I lost the case with google support because I didn’t film Myself putting the phone inside the box , only to notice few months later that the phone did reach in and they credi…

Next time just charge them back with your credit card

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#44

Post by Ephil012 »

jhgg wrote: post #24

Does this apply with https://cloud.google.com/resource-manager/docs/organization-... enabled?

I am on a personal gmail so I can't test this myself. However, I suspect it might not prevent it. The feature you linked seems to just allow you restrict domains that projects within your org can be shared with. The issue is not that you're sharing projects with someone else, but that they're sharing projects with you. So in that case, this feature would do nothing to block that as far as I can tell. That is unless they add the ability to block someone outside sharing stuff with you (which I did not see any mention of after a quick skim of the link you posted).

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#45

Post by judge2020 »

frx wrote: post #29
supriyo-biswas wrote: post #8

I am not even sure what all the fuss is about. AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This model is used because otherwise providing permissions becomes extremely difficult, and users are more likely to throw away the entire concept and settle for one common set of credentials for all users across the project (in the form of…

> AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This is not correct. This would only work if the resource is in the same AWS account. For cross account access, both the principal and the resource need to allow each other. See: https://aws.amazon.com/premiumsupport/knowledge-center/cross...

Technically, but this is more about how 'Account B Admin' must define who (user/principal) can access the resources Account A has already given Account B access to. The difference I see here is that it's not an invite system; Account A does not notify Account B of its new permissions when it grants them, and Account A is not notified when Account B's administrator has defined an access policy for those resources.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#46

Post by autoexec »

EarthLaunch wrote: post #39

A company without customer support is incentivizing everyone to blare every single problem to the largest possible audience. The overall impression is that the company's products are unpleasant and dysfunctional. It's the opposite of advertising. Is not having support really worth the damage this causes to a brand? That said, many people treat support so badly that offering it may be worth avoiding on principle.

> Is not having support really worth the damage this causes to a brand?

Once you reach a certain size the reputation of your brand is almost meaningless. Some of the largest and most successful companies around are almost universally hated and have terrible reputations. Those companies don't care and they continue to make unpopular decisions and actively screw over their customers and their employees all while pulling in record profits.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#47

Post by bradleybuda »

bushbaba wrote: post #35

If a GCP project hosted child porn. And the project admin added you as a co-owner to said project. Would you be legally be at fault or implicated?

No, because thank goodness the law is not executed by automatons, it is a system of humans with human brains.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#48

Post by kyrra »

killingtime74 wrote: post #43
totaldude87 wrote: post #22

I never had a good time with google Support ( not just gcp) One time I sent a trade in device which usps confirmed as delivered to google , google store said that it was just an empty box and no phone was inside … After fighting tooth and nail , I lost the case with google support because I didn’t film Myself putting the phone inside the box , only to notice few months later that the phone did reach in and they credi…

Next time just charge them back with your credit card

This tends to be a terrible idea, unless you really just want to nuke your Google account.

(Googler, opinions are my own. I work on payments.)

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#49

Post by [deleted] »

thesuperbigfrog wrote: post #2

Idea: (never used Google Cloud, no idea of possible impediments) 1. Create throwaway account 2. Create throwaway project using throwaway account 3. Find emails of possible Googlers using public bug tracker 4. Add Googlers' emails to throwaway project 5. Post messages to throwaway project describing the problem 6. Hopefully Googlers understand the issue and can forward the issue to get it resolved

[deleted]

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#50

Post by kelnos »

If this seems like a project that this other company actually uses for anything important, you could start doing things like deleting random cloud resources, like compute instances, storage buckets, etc. (I guess it depends on what permissions they granted your account, though.) That'll definitely get their attention, since they seem to be ignoring your emails.

There's risk, though, whenever you do something that looks malicious: your account might get suspended. Also not sure if you could be legally liable for anything bad you do.

Post reply on HN