Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Student Charged $14k on Stolen Google Cloud Credentials

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Student Charged $14k on Stolen Google Cloud Credentials

#21

Post by travisglines »

boulos wrote: post #19

Sorry this happened to you! Feel free to send me your case number (email in profile), and I'll escalate it. The Support personnel have hopefully been helping out, as all Billing Issues are covered regardless of support tier. I obviously don't know the ins and outs of payment instrument refunds / do debit cards mean that you actually do have to contact your bank, but I'm sure people in Support do.

Thanks for responding to this and offering to escalate boulos.

I certainly don't think a student just learning the ins and outs of a cloud provider's services should be able to spend 10k+ without warnings/thresholds that require configuration to exceed. It would be positive for platform adoption to make that process better.

Re: Student Charged $14k on Stolen Google Cloud Credentials

#22

Post by joecot »

samfisher83 wrote: post #17

Next use a credit card. Basically thanks to credit card laws the bank will go tell google to f off and give you your money back. Debit cards don't have the same protection, but just call your bank or OCS ( https://www.occ.treas.gov/ ). They have a little more bite.

His debit card ended up declining it anyway, but that's not the point. The point is Google thinks he owes them thousands of dollars, and a collection agency is hounding him for the money.

Disputing a charge with your credit card company doesn't change that. The credit card company might side in your favor and reverse the charges, but the original company can still pursue payment with you directly. Their claim can even show up on your credit report. I remember working with a payment processor in Europe that even automated sending a bill to collections if it was charged back by the consumer's credit card company.

Re: Student Charged $14k on Stolen Google Cloud Credentials

#23

Post by motherofzappa »

travisglines wrote: post #21
boulos wrote: post #19

Sorry this happened to you! Feel free to send me your case number (email in profile), and I'll escalate it. The Support personnel have hopefully been helping out, as all Billing Issues are covered regardless of support tier. I obviously don't know the ins and outs of payment instrument refunds / do debit cards mean that you actually do have to contact your bank, but I'm sure people in Support do.

Thanks for responding to this and offering to escalate boulos. I certainly don't think a student just learning the ins and outs of a cloud provider's services should be able to spend 10k+ without warnings/thresholds that require configuration to exceed. It would be positive for platform adoption to make that process better.

This is hilarious. Student doesn’t understand security in depth model, gets owned. Has a sour taste with said cloud provider. At what level do you accept responsibility for shoddy security practices. If the project was truly defunct then you should have closed the project or removed everyone’s access who isn’t project owner. Hindsight is 20/20.

Re: Student Charged $14k on Stolen Google Cloud Credentials

#24

Post by motherofzappa »

joecot wrote: post #22
samfisher83 wrote: post #17

Next use a credit card. Basically thanks to credit card laws the bank will go tell google to f off and give you your money back. Debit cards don't have the same protection, but just call your bank or OCS ( https://www.occ.treas.gov/ ). They have a little more bite.

His debit card ended up declining it anyway, but that's not the point. The point is Google thinks he owes them thousands of dollars, and a collection agency is hounding him for the money. Disputing a charge with your credit card company doesn't change that. The credit card company might side in your favor and reverse the charges, but the original company can still pursue payment with you directly. Their claim can eve…

playing devils advocate, but taking peoples word prima facie is dangerous. Especially when it deals with financial issues. Pretty sure you can any contempt person could game the system if people found out “students” automatically get refunds for bs charges. I think AWS is different as they have their educate program and distinguish between students and free trial customers. AFAIK gcp doesn’t have an education system for students, so it’s harder to differentiate a legitimate request

Re: Student Charged $14k on Stolen Google Cloud Credentials

#25

Post by quickthrower2 »

nitins_jakta wrote: post #12
segmondy wrote: post #11

While you're figuring this out, backup all your data on Google. Google is crazy and could possibly delete all your accounts and data.

Backing up now, thanks. Even worse I'm an Android user. I don't have a good solution for the people that mail me every few months. Oh hey, Google might lock my account because I didn't fork over 14k in fraudulent charges, can you start emailing me from my Outlook email instead?

The idea email is your own domain name. I’m yet to take my own advice though!

Re: Student Charged $14k on Stolen Google Cloud Credentials

#26

Post by quickthrower2 »

motherofzappa wrote: post #24
joecot wrote: post #22

Earlier quoted context omitted.

His debit card ended up declining it anyway, but that's not the point. The point is Google thinks he owes them thousands of dollars, and a collection agency is hounding him for the money. Disputing a charge with your credit card company doesn't change that. The credit card company might side in your favor and reverse the charges, but the original company can still pursue payment with you directly. Their claim can eve…

playing devils advocate, but taking peoples word prima facie is dangerous. Especially when it deals with financial issues. Pretty sure you can any contempt person could game the system if people found out “students” automatically get refunds for bs charges. I think AWS is different as they have their educate program and distinguish between students and free trial customers. AFAIK gcp doesn’t have an education system…

What will these system gamers do with computer power? Mining crypto will make them pennies, and running a business on stolen accounts isn’t sustainable.

Re: Student Charged $14k on Stolen Google Cloud Credentials

#27

Post by duiker101 »

motherofzappa wrote: post #23
travisglines wrote: post #21

Earlier quoted context omitted.

Thanks for responding to this and offering to escalate boulos. I certainly don't think a student just learning the ins and outs of a cloud provider's services should be able to spend 10k+ without warnings/thresholds that require configuration to exceed. It would be positive for platform adoption to make that process better.

This is hilarious. Student doesn’t understand security in depth model, gets owned. Has a sour taste with said cloud provider. At what level do you accept responsibility for shoddy security practices. If the project was truly defunct then you should have closed the project or removed everyone’s access who isn’t project owner. Hindsight is 20/20.

Nice victim shaming you got there. The fault of all of this is 100% on whoever stole the credentials and made those calls. OP could maybe have been more careful but that doesn't mean it's all his fault or that we should be shaming in oblivion. And Google can still try to help rather than just take advantage of the situation. Life is easier when we are not dicks to each other, a little empathy can go a long way.

Re: Student Charged $14k on Stolen Google Cloud Credentials

#28

Post by jameskegel »

duiker101 wrote: post #27
motherofzappa wrote: post #23

Earlier quoted context omitted.

This is hilarious. Student doesn’t understand security in depth model, gets owned. Has a sour taste with said cloud provider. At what level do you accept responsibility for shoddy security practices. If the project was truly defunct then you should have closed the project or removed everyone’s access who isn’t project owner. Hindsight is 20/20.

Nice victim shaming you got there. The fault of all of this is 100% on whoever stole the credentials and made those calls. OP could maybe have been more careful but that doesn't mean it's all his fault or that we should be shaming in oblivion. And Google can still try to help rather than just take advantage of the situation. Life is easier when we are not dicks to each other, a little empathy can go a long way.

I think a lot of the problems we face today are largely unacknowledged by those who create them. The delivery lacked any empathy but does not make it less true. Actions have consequences and ignorance of those outcomes doesn’t mean you can escape them. The world would be a little bit better of a place if we’d stop coddling those who float haphazardly through their own existence.

Re: Student Charged $14k on Stolen Google Cloud Credentials

#29

Post by kkarakk »

I dunno if google lets you do this but amazon/azure will pretty reliably let you create new free tier accounts with fake emails and access them from the same IP. i just create a new debit/credit card every 6 months(it's pretty hassle free in india).

i do pay for production instances, i just don't want to mess around on those production instances

Re: Student Charged $14k on Stolen Google Cloud Credentials

#30

Post by kkarakk »

quickthrower2 wrote: post #26
motherofzappa wrote: post #24

Earlier quoted context omitted.

playing devils advocate, but taking peoples word prima facie is dangerous. Especially when it deals with financial issues. Pretty sure you can any contempt person could game the system if people found out “students” automatically get refunds for bs charges. I think AWS is different as they have their educate program and distinguish between students and free trial customers. AFAIK gcp doesn’t have an education system…

What will these system gamers do with computer power? Mining crypto will make them pennies, and running a business on stolen accounts isn’t sustainable.

there are entire dark market businesses built out of finding secrets and deploying a crypto miner as fast as possible and mining as much as possible.

that's just one use case, DDOSing an API/website through seemingly legit requests from the G3's cloud infrastructure is another.

Lots of things you can do with massive amounts of computing power. It doesn't have to be sustainable in the short term, you just keep repeating the process and the value adds up fast

Post reply on HN