Live data from Hacker News

The complete list of alternatives to all Google products – TechSpot

techspot.com

1–10 of 17 posts

Re: The complete list of alternatives to all Google products – TechSpot

#4
> Authy

I don't trust Authy and a discerning security professional shouldn't either. There are _a lot_ of red flags.

* First: Forcing users to download their stupid app. TOTP is a widely documented protocol. There shouldn't be a need to download a particular app unless there is an ulterior motive.

* Second: secrets are stored in the cloud. Guess what the key to access them is? An SMS. Yes those un-encrypted, un-signed, un-authenticated, spoof-able, forward-able, plain-text, non-guaranteed delivery, MITM ready, message system. Seriously?

* Third: No choice for migrating to another app. Even though Authy has access to your secrets, you cannot export them. There is an ulterior motive here. Authy does not want you leaving them and will play dirty to keep your on their platform.

* Fourth: You will get locked out of everything if Authy decides to pull the plug on you. If you get 'cancelled' for having a non-popular opinion, Authy could revoke access to every single one of your accounts.

Avoid like dysentery.

Re: The complete list of alternatives to all Google products – TechSpot

#5
Any good alternate to google Places API. I need a kind of places name autocomplete to make sure users are able to look up something by landmark/location names. Google places autocomplete is very pricy. Is there any open database for such use case. I can have own look up around this data.

Re: The complete list of alternatives to all Google products – TechSpot

#7
post #4

> Authy I don't trust Authy and a discerning security professional shouldn't either. There are _a lot_ of red flags. * First: Forcing users to download their stupid app. TOTP is a widely documented protocol. There shouldn't be a need to download a particular app unless there is an ulterior motive. * Second: secrets are stored in the cloud. Guess what the key to access them is? An SMS. Yes those un-encrypted, un-signe…

Yes, use aegis instead of authy or google authenticator. Open source and option to export your keys (both encrypted and unencrypted)

Re: The complete list of alternatives to all Google products – TechSpot

#8
My own personal alternatives, but real ones not just another company:

- search :: use one or another, simply because the SOLE in the list really free is YaCy (distributed search based on solr) and it's actually not much good due to the small indexing activity by participants nodes. Seeing thing like https://noscriptfingerprint.com I consider privacy as an impossible thing, my strategy is simply regular wipe of WebVM [1] profile and round robin/semi-random choice of different search engines;

- mail :: simply do NOT use a webmail. It's true that we do not have modern MUA for generic users, but we still have modern MUA, like notmuch or mu4e, with some frontends from mutt to astroid not only Emacs. Having a personal domain name (to not being tied to any specific vendor) and pay a standard mail service (not one who craft proprietary protocols "for privacy") with IMAPs and SMTPs and that's done, mail syncing if needed (OfflineIMAP/Mbsync) or mail grabbing to a personal desktop or server (to serve multiple personal desktops) like classic fetchmail+MailDrop and done, a FAR better and faster than GMail solution;

- modern WebVM :: Firefox is the sole left "a bit FLOSS";

- Google Authenticator :: no need for a TOTP on a personal local-first infra, if needed classic ssh + key based auth is far simpler and better;

- Drive :: being local my Drive alternative is typically called hard-disk (ssd, to be more precise) in various forms, from classic 2.5" with a caddy to portable ones M.2 or 2.5" sata with built-in usb adapter in the case, they are far faster than Drive, far more reliable and effective as part of a personal infra with relevant backups;

- Calendar :: org-agenda is FAR superior to a point I see no reasons to a UI like Calendar;

- Docs suite :: I have org-mode, notes accessed/managed via org-roam/org-attach and classic LaTeX with personal templates. Issues might pops up for collaboration with people who do not know them, but overall results are so superior that there is no reasons to use a classic modern office suite;

- Photos :: even Shotwell works well enough;

- YouTube :: podcasts fetched via rss and local storage with a local player works beautifully well;

- Google Translate :: one or another in privacy terms are the same, unfortunately a good local version can't exists since it's a giant ML system, or to be more precise it can exists as a distributed tool, but so far no one have developed something AFAIK;

- Analytics :: I fail to see purpose for personal websites, for commerce etc anything FLOSS on their own server it's ok;

- Maps :: hard to find a better option, OSM is better in very few places, but not in the rest 99% of my usage so...

- Play Store :: any distro / FLOSS OS repos are FAR superior simply because they are the same things, without the crappy commercial part;

- Chrome OS :: I see no point i reviving dumb terminals with modern WebVM: if someone live on webcrapps... Well, it's better change them;

- Android :: I see some reasons to use a smartphone but in too many case it's not that needed.

- Hangouts :: Jami works well enough, no server required, SIP/RTP are fully interoperable with classic PSTN...

- Domains :: there are countless actors who sell domains...

Long story short: please do not look for "alternatives" in the sense of "copies/variant of something" but alternative paradigms. They are neglect these days, but still exists and often they are FAR superior to commercially backed ones.

[1] also known as "browsers" for legacy reasons

Re: The complete list of alternatives to all Google products – TechSpot

#9
post #7
post #4

> Authy I don't trust Authy and a discerning security professional shouldn't either. There are _a lot_ of red flags. * First: Forcing users to download their stupid app. TOTP is a widely documented protocol. There shouldn't be a need to download a particular app unless there is an ulterior motive. * Second: secrets are stored in the cloud. Guess what the key to access them is? An SMS. Yes those un-encrypted, un-signe…

Yes, use aegis instead of authy or google authenticator. Open source and option to export your keys (both encrypted and unencrypted)

Would prefer a cross-platform option. That one appears to be Android only.

Re: The complete list of alternatives to all Google products – TechSpot

#10
post #4

> Authy I don't trust Authy and a discerning security professional shouldn't either. There are _a lot_ of red flags. * First: Forcing users to download their stupid app. TOTP is a widely documented protocol. There shouldn't be a need to download a particular app unless there is an ulterior motive. * Second: secrets are stored in the cloud. Guess what the key to access them is? An SMS. Yes those un-encrypted, un-signe…

Aren't the keys encrypted with a PIN of your own chosing which you set and verify in the app?

--

As a side note, it seems to me that what you call "ulterior motive" is essentially vendor lock-in and I don't think that qualifies as an "ulterior motive".

Post reply on HN