Recently, a company in Kenya added me to their Google Cloud project without my permission. At first, I thought I had mistakenly accepted an invite to their project. However, I swore that wasn’t the case. To test my theory, I tried creating an empty project and invited my other Google account to it. I discovered that Google Cloud lets you add any email to a project without getting their permission or notifying them. Google doesn’t even send an email asking you to accept the invitation. It just adds you automatically without telling you. The end result is you can quite literally just type in any Google Cloud account and associate it with your project without them ever knowing. The worst part is that you can’t leave the project after you’re added. Google requires the project owner remove you. They provide no way to remove yourself. I’ve tried contacting the company that added me but they’ve not responded to my requests. I also tried contacting Google support and they’ve been less than helpful. At first, they thought that my account was hacked. I pointed out that this was not due to a hack, but due to Google’s faulty invite system. They responded back and said they didn’t see any association between my email and the project. So they listed the case as resolved and said they couldn’t discuss any further. This is despite the fact the unwanted project still appears on my GCP dashboard. I suspect they didn’t see any association because they were just checking the projects owned by my account and not checking projects I’ve been added to. This whole situation seems like a recipe for unwanted spam since you can be added to projects without permission and can’t ever remove yourself. My biggest fear is if that company uses the project to do something malicious then my account might be banned by association. Overall, this is a major oversight on Google’s side and is a huge security and privacy risk. To date, I’ve still been unable to get any help from Google to resolve this issue. If there’s any Googlers willing to help, I would be extremely grateful.
Story Published at: December 31, 2022 at 02:57AM
Story Published at: December 31, 2022 at 02:57AM