3 ms·

The issue is different from this. Allowing someone within a company to access a resource without asking them is not as big of a deal. The issue here is people o

The issue is different from this. Allowing someone within a company to access a resource without asking them is not as big of a deal. The issue here is people outside your company can add you to projects without consent. Imagine you're a malicious actor and want to spam some company's Google Cloud Dashboard. You could just create a 100 different projects and add the company's users to those projects automatically, even though you're not part of that company. Those projects can never be removed or deleted from the dashboard. So every user at the company you're trying to spam can never get rid of it (without Google support intervening maybe). Or let's say you're a malicious actor trying to get someone in trouble. You could create a Google account and hide all traces of who created it. Then you could just create a project doing something illegal (e.g. hosting illegal content) and then add someone to the project. When the authorities find out about the project, the person you're targeting will get investigated for hosting illegal content.

judge2020 4y ago
> The issue here is people outside your company can add you to projects without consent. Same for AWS, granting an identity in another account access to resources in your own AWS project also requires no approval on the other side. The issue you seem to have with Google is that it's verbose about showing everything you have access to. As for the company scenario, this is effectively not an issue for Google Workspace-enabled domains since your default project list shows projects under your domain (if you're not parented to gmail.com).
- Ephil012 4y ago
  I saw another comment which said this wasn't quite the case. https://news.ycombinator.com/item?id=34193624 https://news.ycombinator.com/item?id=34193624 Even if it is the case, it is still an issue because it can be used for abuse. If you wanted to pin abuse on someone you just need to add them to the project doing something illegal. Google tends to be trigger happy about banning so it could affect someone. I bet there are avenues for companies to deal with a situation like this, but it still affects individuals which is a big problem. Especially if your personal account gets banned. I'd also argue that it's a spam issue for companies (albeit less than it is for individuals). You may not see it by default for companies, but it will still appear in some lists throughout the UI probably. I think honestly both AWS / GCP should ask for permission to be invited when you're adding someone outside your company.

judge2020 4y ago

> The issue here is people outside your company can add you to projects without consent. Same for AWS, granting an identity in another account access to resources in your own AWS project also requires no approval on the other side. The issue you seem to have with Google is that it's verbose about showing everything you have access to. As for the company scenario, this is effectively not an issue for Google Workspace-enabled domains since your default project list shows projects under your domain (if you're not parented to gmail.com).

Ephil012 4y ago
I saw another comment which said this wasn't quite the case. https://news.ycombinator.com/item?id=34193624 https://news.ycombinator.com/item?id=34193624 Even if it is the case, it is still an issue because it can be used for abuse. If you wanted to pin abuse on someone you just need to add them to the project doing something illegal. Google tends to be trigger happy about banning so it could affect someone. I bet there are avenues for companies to deal with a situation like this, but it still affects individuals which is a big problem. Especially if your personal account gets banned. I'd also argue that it's a spam issue for companies (albeit less than it is for individuals). You may not see it by default for companies, but it will still appear in some lists throughout the UI probably. I think honestly both AWS / GCP should ask for permission to be invited when you're adding someone outside your company.