Tell HN: Google Cloud lets anyone add you to a project without your permission • Hacker News Board

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#51

Post by [deleted] » Sat, Dec 31, 2022, 5:19 AM UTC

[deleted]

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#52

Post by _8j50 » Sat, Dec 31, 2022, 5:19 AM UTC

I have "abused" this myself, there is a nice blackhat talk about just this along with a tool to help figure out where principals have been granted permission: https://www.youtube.com/watch?v=Ml09R38jpok

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#53

Post by bboygravity » Sat, Dec 31, 2022, 5:20 AM UTC

autoexec wrote: post #46

EarthLaunch wrote: post #39

A company without customer support is incentivizing everyone to blare every single problem to the largest possible audience. The overall impression is that the company's products are unpleasant and dysfunctional. It's the opposite of advertising. Is not having support really worth the damage this causes to a brand? That said, many people treat support so badly that offering it may be worth avoiding on principle.

> Is not having support really worth the damage this causes to a brand? Once you reach a certain size the reputation of your brand is almost meaningless. Some of the largest and most successful companies around are almost universally hated and have terrible reputations. Those companies don't care and they continue to make unpopular decisions and actively screw over their customers and their employees all while pullin…

Maybe your confounding "large company" with monopoly or duopoly?

Can you give examples of large companies with more than 1 competitor who get away with treating customers badly in the long run?

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#54

Post by eyelidlessness » Sat, Dec 31, 2022, 5:21 AM UTC

kyrra wrote: post #48

killingtime74 wrote: post #43

Earlier quoted context omitted.

Next time just charge them back with your credit card

This tends to be a terrible idea, unless you really just want to nuke your Google account. (Googler, opinions are my own. I work on payments.)

This is consistent with a recent posting by a non-Googler.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#55

Post by foreverCarlos » Sat, Dec 31, 2022, 5:22 AM UTC

kyrra wrote: post #48

killingtime74 wrote: post #43

Earlier quoted context omitted.

Next time just charge them back with your credit card

This tends to be a terrible idea, unless you really just want to nuke your Google account. (Googler, opinions are my own. I work on payments.)

Over the past serval months I realized with certainty that I should never use my personal Gmail account for any other Google services.

Gmail is Gmail only, for everything else create separate Google accounts you are not afraid to lose.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#56

Post by Ephil012 » Sat, Dec 31, 2022, 5:22 AM UTC

MonkeyMalarky wrote: post #32

benguild wrote: post #21

This is accurate. I have a project that I don’t recognize stuck on my Console as well.

Can you do anything annoying but harmless in the project?

I don't know about their case, but in my case I can only view the project, but can't modify it.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#57

Post by globalnode » Sat, Dec 31, 2022, 5:23 AM UTC

cant you look for alternative products? or if there arent any, make them yourself?

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#58

Post by blinkingled » Sat, Dec 31, 2022, 5:25 AM UTC

jhgg wrote: post #24

Does this apply with https://cloud.google.com/resource-manager/docs/organization-... enabled?

No, as this is at the granting org level - so the org owner may restrict it to their domain and anyone under it won't be able to assign privileges to an identity from a random domain, but that's not what this is about - If I own the org and project I can opt to not restrict the domains and invite anyone.

However IIRC Owner Role grants require email invite acceptance, just not sure if that's policy driven as well - https://issuetracker.google.com/issues/111843590?pli=1

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#59

Post by ramijames » Sat, Dec 31, 2022, 5:26 AM UTC

Same goes for Google documents. Sharing docs or spreadsheets with malicious content is common. It's frustrating that Google doesn't lock that down.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#60

Post by NavinF » Sat, Dec 31, 2022, 5:27 AM UTC

Ephil012 wrote: post #41

iueotnmunto wrote: post #20

Earlier quoted context omitted.

TIL google had support tickets, I thought they largely didn't communicate with their client base

They don't except for certain products. Google Cloud has a paid support plan. The free tier only lets you file tickets for billing issues. I ended up just filing this ticket as a billing ticket even though it's really not

Yeah I had similar experiences with GCP support a couple of years ago when I discovered that killing a k8s cluster takes hours. My issue was technically related to billing since I was getting billed for GPU VMs the whole time, but their free support was completely useless. They probably exist only to meet some checkbox requirement for accepting credit card payments