Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google Cloud lets anyone add you to a project without your permission

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 130 posts

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#61

Post by moonchrome »

bboygravity wrote: post #53
autoexec wrote: post #46

Earlier quoted context omitted.

> Is not having support really worth the damage this causes to a brand? Once you reach a certain size the reputation of your brand is almost meaningless. Some of the largest and most successful companies around are almost universally hated and have terrible reputations. Those companies don't care and they continue to make unpopular decisions and actively screw over their customers and their employees all while pullin…

Maybe your confounding "large company" with monopoly or duopoly? Can you give examples of large companies with more than 1 competitor who get away with treating customers badly in the long run?

Oracle

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#62

Post by owenmarshall »

kyrra wrote: post #48
killingtime74 wrote: post #43

Earlier quoted context omitted.

Next time just charge them back with your credit card

This tends to be a terrible idea, unless you really just want to nuke your Google account. (Googler, opinions are my own. I work on payments.)

Not a googler, but: this is absolutely right.

Chargebacks are the mutually assured destruction of banking. There’s nothing wrong with firing a nuclear weapon if you truly feel it’s in your best interests; if you do, expect that your adversary will respond in kind and terminate all business with you now and in the future.

Sometimes that’s the right move, sometimes it’s not, just go into it with eyes open.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#63

Post by Ephil012 »

dilyevsky wrote: post #23
Ephil012 wrote: post #16

Earlier quoted context omitted.

Yeah, the big issue though is you can add people outside your company. Not just within your gsuite. Adding within the gsuite is not as big of the deal, but the ability to add anyone outside your company is a big issue because it enables mass spam

Yeah the thing is gcp account does not imply one-to-one mapping to gsuite domain. There are perfectly valid use cases for having multiple projects granting iam roles to multiple gsuite domains

Yeah true, but even with multiple domains I’d consider that within your company (as long as those domains are all owned by the company). If it’s outside your company (e.g. maybe your company is working with another company) then there should be some sort of mechanism to accept/decline invites

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#64

Post by readams »

bboygravity wrote: post #53
autoexec wrote: post #46

Earlier quoted context omitted.

> Is not having support really worth the damage this causes to a brand? Once you reach a certain size the reputation of your brand is almost meaningless. Some of the largest and most successful companies around are almost universally hated and have terrible reputations. Those companies don't care and they continue to make unpopular decisions and actively screw over their customers and their employees all while pullin…

Maybe your confounding "large company" with monopoly or duopoly? Can you give examples of large companies with more than 1 competitor who get away with treating customers badly in the long run?

Google cloud is a distant third in the cloud space. So claiming they are a monopoly is frankly pretty ridiculous.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#65

Post by iJohnDoe »

015a wrote: post #6
thesuperbigfrog wrote: post #2

Idea: (never used Google Cloud, no idea of possible impediments) 1. Create throwaway account 2. Create throwaway project using throwaway account 3. Find emails of possible Googlers using public bug tracker 4. Add Googlers' emails to throwaway project 5. Post messages to throwaway project describing the problem 6. Hopefully Googlers understand the issue and can forward the issue to get it resolved

Idea: 1. Create a throwaway account. 2. Add a bunch of professional developers' at big companies email addresses to the account. Just shoot in the dark: johnanderson@google.com, mikejohnson@airbnb.com, wandamaximov@apple.com, throw in a couple common email aliases as well like developers@twitter.com or mobileteam@airbnb.com 3. Publish a bunch of apps to the play store which clearly breaks their app store policies 4.…

Actually, add @apple.com emails. They are a large GCP customer for iCloud.

You could potentially bring down iCloud.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#68

Post by owenmarshall »

kelnos wrote: post #50

If this seems like a project that this other company actually uses for anything important, you could start doing things like deleting random cloud resources, like compute instances, storage buckets, etc. (I guess it depends on what permissions they granted your account, though.) That'll definitely get their attention, since they seem to be ignoring your emails. There's risk, though, whenever you do something that loo…

> There's risk, though, whenever you do something that looks malicious: your account might get suspended.

I wonder what happens to your personal and unrelated Google account if the project manages to get itself suspended.

I bet this could be weaponized fairly effectively - add a bunch of Google insiders to a project and get it noticed by an automated enforcement system. Turn the labyrinth against itself.

Post reply on HN