Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have gained admin access to numerous GCloud Organizations by accident

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 132 posts

Re: I have gained admin access to numerous GCloud Organizations by accident

#51

Post by 8organicbits »

tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

> by virtue of you having posted this here

But it's not even the first time this issue was posted here. I'm not sure that approach works with Google.

https://news.ycombinator.com/item?id=34193047

Re: I have gained admin access to numerous GCloud Organizations by accident

#52

Post by yesco »

ghusto wrote: post #25
secondcoming wrote: post #17

Be very careful. Even though you're trying to do The Right Thing don't alert these companies to the fact you've been accessing their accounts without permission.

I'm seeing a lot of these kinds of comments, and think this might just be an American worry (because it's such a litigious place)? People in the Netherlands and England where I also lived for a short while, are pretty chill with these kinds of things. I can't imagine them doing anything other than thanking you profusely. I mention this because I'd rather this kind of attitude wasn't imported to Europe.

I was under the impression that the key concern here is being criminally prosecuted, not sued. Even if they obviously didn't do this on purpose, depending on how they communicate it to the companies involved, the worse case scenario is that it could be perceived as some kind of phishing attack / fakeout done with malicious intent. Even if they could prove their innocence, no one wants to deal with something scary like that in court.

While I'm not familiar with the nuances of each European nation's computer fraud laws regarding this, I can't imagine this would be any different there. Especially as Cybersecurity becomes an increasingly international concern.

Re: I have gained admin access to numerous GCloud Organizations by accident

#53

Post by [deleted] »

leesalminen wrote: post #12
invalidname wrote: post #7

As a person who paid for Google's "Gold" support. They are less than useless. Don't go into these accounts at all. Not even to try and help/contact them. Laws about this are very vague and no one within the ORG would want to admit that they made a mistake by adding you.

I’ve had access to both Google’s and Amazon’s paid support options (up to and including enterprise support). Amazon’s support has gone above and beyond for me over the years in ways I didn’t even expect or ask them to. In comparison, I agree with you that Google’s support is useless. My experiences with AWS support have actually left me with a positive impression of the platform, while my experiences with Google rein…

[deleted]

Re: I have gained admin access to numerous GCloud Organizations by accident

#54

Post by NegativeK »

jacobsenscott wrote: post #27

Isn't this a little like reaching out to Linus because someone changed their home directory permission to rwxrwxrwx? It sucks for them, but what could google do?

Maybe if Linus maintained a paid product that included that home directory.

Re: I have gained admin access to numerous GCloud Organizations by accident

#55

Post by fnimick »

koolba wrote: post #49
tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

> You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. In that case no point in following up at all right? Just post on HN and hope someone in the right spot sees it? > This almost always works :) That’s the type of SLA one can rely on! > Maybe edit your OP with a way to c…

> Just post on HN and hope someone in the right spot sees it?

That's how a lot of Google tech support happens. If you get banned by mistake, you have far better luck making noise here or on Twitter vs actually going through support.

We had an app mistakenly banned that we only got human eyes on by calling in favors from old friends who work at Google. It's asinine.

Re: I have gained admin access to numerous GCloud Organizations by accident

#57

Post by ethbr0 »

nocommandline wrote: post #35
elzbardico wrote: post #13

Even if you manage to reach out to Google, I doubt they will do anything like remove your group from those roles. From their POV you could be just trying to social engineer them into removing someone who has legitimate access. I think you have better chances contacting people in the org who added your group to those roles.

Google shouldn't automatically remove you but 1. They should contact the firms involved, make them aware of the situation and then the firms will take a decision on whether to remove or not. 2. They should then look over GCP design and see if there's something that they can do to prevent a reoccurrence of this type of error/mistake

I have a similar-but-different problem: a commonly used Gmail address that apparently someone(s) not me was using out in the wild for serious business.

Among other things, I received:

  Interview requests for jobs to which I never applied
  A background screening for a FL sheriff's job
  Legal communications for buying a home
  Business relationship emails
  Account and subscriptions for a variety of services
Relevant point being -- every single one of these counterparties had no idea what to do with me responding "I am not the person who you've been talking with about this. They appear to be using my email. Please ask them to update their email."

It made me realize how shitty most people are at dealing with anything other than business-as-usual.

Re: I have gained admin access to numerous GCloud Organizations by accident

#58

Post by laweijfmvo »

ghusto wrote: post #25
secondcoming wrote: post #17

Be very careful. Even though you're trying to do The Right Thing don't alert these companies to the fact you've been accessing their accounts without permission.

I'm seeing a lot of these kinds of comments, and think this might just be an American worry (because it's such a litigious place)? People in the Netherlands and England where I also lived for a short while, are pretty chill with these kinds of things. I can't imagine them doing anything other than thanking you profusely. I mention this because I'd rather this kind of attitude wasn't imported to Europe.

For me it's a Google worry. I'd be terrified they'd delete my Google (Gmail) account with no way to recover.

Re: I have gained admin access to numerous GCloud Organizations by accident

#60

Post by ethbr0 »

tapoxi wrote: post #20
elzbardico wrote: post #18

Earlier quoted context omitted.

Out of curiosity, I tried to search for the specific function of Support Engineer both for AWS and Google on several job boards. It is a mostly un-scientific approach of course, but the results are as expected. It doesn't even look like google hires Support Engineers. LOL

They outsource it. I'm on the U.S. East Coast. My last GCP support ticket ended up in Romania.

And nothing against Romanians! I work with a ton of brilliant folks there.

Outsourcing inevitably creates a firewall between engineering and support that shouldn't exist though.

In a properly functioning org, support has a way to escalate quickly to engineering if it's confirmed "This is broken." Engineering in turn uses those incoming requests to recognize flaws in their own products.

Outsourcing creates "Hide behind the SLAs and remain ignorant of any issues you've created" barriers that will ultimately sink a company.

Post reply on HN