2 ms·
> The issue here is people outside your company can add you to projects without consent. Same for AWS, granting an identity in another account access to resour
by judge2020 4y ago
> The issue here is people outside your company can add you to projects without consent.
Same for AWS, granting an identity in another account access to resources in your own AWS project also requires no approval on the other side. The issue you seem to have with Google is that it's verbose about showing everything you have access to.
As for the company scenario, this is effectively not an issue for Google Workspace-enabled domains since your default project list shows projects under your domain (if you're not parented to gmail.com).
- Ephil012 4y agoI saw another comment which said this wasn't quite the case. https://news.ycombinator.com/item?id=34193624 https://news.ycombinator.com/item?id=34193624 Even if it is the case, it is still an issue because it can be used for abuse. If you wanted to pin abuse on someone you just need to add them to the project doing something illegal. Google tends to be trigger happy about banning so it could affect someone. I bet there are avenues for companies to deal with a situation like this, but it still affects individuals which is a big problem. Especially if your personal account gets banned. I'd also argue that it's a spam issue for companies (albeit less than it is for individuals). You may not see it by default for companies, but it will still appear in some lists throughout the UI probably. I think honestly both AWS / GCP should ask for permission to be invited when you're adding someone outside your company.