Hacker News Reader

Comment by bilal4hmed | Hacker News Reader

Its only 1 way which means an Apple user can send a link to a non ios user to join in. I as an Android user cant do that.

Cross platform like whatsapp, duo or signal still win here

View on HN

From Duo wiki: “ In August 2020, it was reported that Google was planning to eventually replace Google Duo with Google Meet, but would continue to support Duo and "invest in building new features" in the long term.[2]”

I don’t know exactly what that means. Seems like not much and Duo is still a priority. But all the deprecating and switching of Google products makes them a non win for me. It’s hard for me to get friends to try a new service. If it disappoints, the next time is that much harder.

yeah who knows, that news came around the time Soltero joined Google and had all the communications apps under him. So far he has done a good job of consolidating Googles messaging platforms and Google Workspace.

Duo is huge in India and I use it a lot with family, so I can vouch that the call video and audio quality is amazing.

Switching apps ( like the whatsapp to signal ) is always painful though.

It's no different than Hangouts. We got fed misleading headlines about how it was KILLED for years, but it seems like as far as users are concerned, it'll just be a UI change. Behind the scene they are migrating it to Chat, but all your chats and contacts and histogram will be migrated over.

I would assume something similar with Duo. It'll probably change look and get merged into Meet, but it'll probably still be more or less the same app.

As a Fi user, they did kill Hangouts for me. I can't use it for SMS and its only other advantage is it takes up a large chunk of my gmail tab. Why should I use it?

No one is forcing you to use it, and moving SMS to Voice wasn't great (though Hangouts never really was meant to be an SMS app), but for people like me who have used Hangouts for over a decade to chat with friends and family, it definitely isn't the doomed end most headlines made it sound. My family were asking me if we had to start looking for another place to chat 3 years ago, yet Hangouts is still up and working fine.

WhatsApp: Owned by a company that makes money invading your privacy.

Duo: owned by a company that makes money invading your privacy.

I had to get upper management involved once when trying to buy an Airport Express, because they wouldn't allow me to make a purchase at the Apple store without leaving my name and contact details.

It's ethically OK to lie in these situations. You think I gave Radio Shack my real PII whenever I wanted to buy a battery?

I've given out 212-555-1234 as my phone number to so many random places, that I've accidentally given it out when I didn't need to hide my real number.

Also just about everywhere... (xxx) 867-5309 works for rewards cards and things like that. Also at Walgreens, you can use (420) 420-4204. That was the number the cashier gave me there since I told them I didn’t have a rewards card.

Just about everywhere: (local area code)-123-4567. 10 years ago I was almost always the only entry, if you're ever in the Cleveland feel free to use Aaaron ;-) If they don't like 123, use the store phone # prefix

I shouldn't have to lie. They didn't accept my "No.", nor that my full legal name was "Donald Fauntleroy Duck", until the case got escalated.

There's a privacy carve-out for stores and selling items because you effectively have to provide this information when paying with card for fraud prevention (both online and for in-store loss prevention).

I was paying cash. In my country you do not give any details when paying with card, you simply pay and you are on your way.

they wouldn't allow me to make a purchase at the Apple store without leaving my name and contact details

Was this recent? I was able to buy a new Mac just a few weeks ago without giving any information.

It was some years ago, I haven't been back since.

Signal: developed by a non-profit organization, free and open source, end-to-end encrypted in all regions, no encryption key hosting arrangements with any government-owned third party firm

Also developed by guy who is fighting against you being able to install it without involvement with a company that makes money by invading your privacy, who also has a history of working for companies making money invading your privacy.

Signal offers an APK that does not require the use of Google services.

Signal: requires disclosing a phone number to everyone you use it with

Which means the other person knows it's me, right?

Might be troublesome if you don't want the other person to know it's you, though.

But that's probably not a problem in day to day communication with family and friends.

> Might be troublesome if you don't want the other person to know it's you, though.

You're mixing privacy and anonymity. Signal offers privacy from snooping, they have never claimed or tried to provide anonymity. Two very different use cases.

There are better ways to verify someone is who you think they are, e.g. asking them about an inside joke that you only told them in person at some point in the past, or what art you have up on the wall in your dining room.

Also, you might in some cases want to share knowledge or evidence without disclosing your identity, and phone numbers miserably fail for that use case.

> Signal: requires disclosing a phone number to everyone you use it with

Signal also got distracted with a cryptocurrency scheme [1]. That shot their credibility in many circles.

[1] https://www.schneier.com/blog/archives/2021/04/wtf-signal-ad...

Not exactly. They're evaluating adding micro payments to the app.

These micro payments will be handled by a third party which uses a crypto currency in the exchange.

The feature itself is good imo. Though I'm prolly never gonna use it because of the crypto intermediary.

First, the "also" is misplaced. Signal's telephone number requirement is a privacy feature; it's not that Signal wants your phone number, but that using phone numbers as identifiers allows them to build a social graph --- every mainstream messaging app involves a social graph --- without keeping plaintext contact lists serverside, which is what every other mainstream messenger does. That's not a small thing; the information in those contact lists is one of the highest priority targets for any state-level adversary.

I don't love the cryptocurrency stuff either. I'm not defending it. But "shot their credibility" is an overstatement.

Fair on both points. The “also” is misplaced as most users have zero problem with Signal processing their contacts. And “shot their credibility” was hyperbole. “Severely damaged, albeit repairably” is more accurate.

> no encryption key hosting arrangements with any government-owned third party firm

Not really needed when your IME is spying on you. Signal in such an arrangement becomes security theater. They acknowledge this is a problem on their support site but never make any attempt to educate new users to the app: https://support.signal.org/hc/en-us/articles/360055276112-In... . It is arrogant to dismiss concerns about commonly-used IME's when people rely on this app for their own protection.

This was discussed previously on HN if anyone's interested in reading about the response, or lack thereof to the criticism: https://news.ycombinator.com/item?id=25758995

>free and open source

Want to also point out that months go by without server code being published: https://www.xda-developers.com/signal-updates-public-server-...

Also, when users protested reliance on Google's store, analytics, and play services, Moxie chose to attack the forks and made us wait for years to get a direct APK without the requirements available off their site. I acknowledge that there's legitimate reasons why this was done, but all we get are excuses and silence for long periods of time when these problems crop up. It is not in the spirit of opensource/free software development to attack your own community.

My point is that Signal is preferable to Apple Messages for privacy and security. I am not claiming that Signal is the best solution for every use case. (For instance, Matrix is superior if you do not want to be tied to a phone number.)

> Not really needed when your IME is spying on you.

Users can choose an open source keyboard on Android, such as AnySoftKeyboard or the default Android Keyboard (on AOSP installations). I don't know of any open source keyboards on the App Store for iOS, but the lack of an open source keyboard on iOS does not justify compromising encryption keys for Apple Messages users in certain regions.

Signal is not responsible for the security of the rest of the user's system, and if a user is using a keyboard that leaks information, then that also affects Apple Messages and any other app they are using, not just Signal.

> Want to also point out that months go by without server code being published

The Apple Messages server and clients are completely proprietary, so Signal is still preferable even though it had previously released server source code with a delay.

> Also, when users protested reliance on Google's store, analytics, and play services...

Apple Messages is only available as an app on iOS, iPadOS, and macOS, with no option to fork because it is closed source. FaceTime is the same, but now also has a web app with limited functionality. On Android, Signal is still preferable in this area because it is fully available, can be used without Google Play Services, and can be distributed independently of an app store.

I'm not comparing Signal to Apple Messages, I am criticizing the promotion of Signal as a superior alternative while its developers will not address a major practical security concern.

>Users can choose an open source keyboard on Android

Then they should be made immediately aware of this in using Signal on Android. The IME issue is not going to be well-known outside the tech bubble.

> Then they should be made immediately aware of this in using Signal on Android.

Does any messaging app do this on any platform? You're demanding something that, as far as I'm aware, no messaging app currently does. Signal at least published the FAQ page, which you linked earlier, even though it's not their responsibility to ensure that the user's device is free of third-party spyware.

This entire discussion is about FaceTime and Apple Messages, which is why Signal is being compared to both. And Signal is superior to these services for privacy and security.

> Not really needed when your IME is spying on you. Signal in such an arrangement becomes security theater.

This is not a signal issue. Literally every single app that gets user input from a keyboard suffers from this issue. Saying this is a signal issue is like saying flat tires are a ford issue.

> >free and open source > Want to also point out that months go by without server code being published:

Is there some unwritten rule that a open source project must publish code every x days to be considered open source? All of signals code has always been open source and always will be.

> Also, when users protested reliance on Google's store, analytics

Analytics? Care to show me where they ever used them? 99% sure they have never used them.

> Moxie chose to attack the forks

It takes a lot of money and man hours to maintain the servers and infrastructure for signal, why should OWS pay for other projects to use it? Signal is 100% open source, if someone thinks they can create a better replacement... They are free to take all of signals code and make their own app. But don't expect OWS to pay for the infrastructure and let them leech.

FaceTime: Owned by a notoriously secretive and litigous company using closed source and unverifiable claims

I'm not saying that Apple is somehow abusing your privacy in ways you don't know, but I am saying you don't really know one way or the other and largely cannot verify that their software is doing what they claim it does

FaceTime: Owned by a notoriously secretive and litigous company using closed source and unverifiable claims

Signal is open source, by the way.

>forcing someone to create an account that uses their phone number and installs an app on their device

If I had any choice I would decline to join a whatsapp or signal call.

Phone number authentication is pretty nasty but it seems to be the only somewhat reliable method of spam prevention. It seems to be next to impossible to get extra phone numbers without government ID and large costs.

These days even most email providers require phone number authentication to register.

I'll take the spam thanks.

My guess is if they want to roll out wider competitive support for FaceTime, they just need to take their web version, which is probably a PWA, and wrap it in Electron for Windows and whatever the heck Android does with PWAs to put on the Play Store, and add the ability to log in.

This is a good first step though, and given I know people who only have Duo to video chat with their non-iOS contacts, this is going to be a blow to some competitors when that's no longer needed.

I think the main use case is participating in facetime via link rather than adopt facetime as your video solution. They would rather you buy into the apple ecosystem

To be clear are you saying that a web user has no way to initiate a call? They can only join via one-time link to a call started by a user on Apple hardware?

That is correct

So an Apple user creates a facetime call and sends the invite link to Android & Windows user. They then join on to the call using their browsers.

Non iOS devices wont be able to make a call. The web interface is just a way to join a call.

So, unidirectional Zoom.

I think it's still pretty unclear at this point, because "an Apple user" can refer to someone with an AppleID using a web-browser on another platform.

Unless of course they made additional statements somewhere I'm unaware of (and maybe could you provide some source to further explain).

So Apple user using an iOS or MacBook device, not just an Apple user? Presumably on a supported iOS or macOS version too which also limits the devices too.

Reply on news.ycombinator.com