The complete list of alternatives to all Google products – TechSpot | Hacker News Reader

The complete list of alternatives to all Google products – TechSpot

techspot.com

39 pointsjohndfsgdgdfg15 comments

> Authy

I don't trust Authy and a discerning security professional shouldn't either. There are _a lot_ of red flags.

* First: Forcing users to download their stupid app. TOTP is a widely documented protocol. There shouldn't be a need to download a particular app unless there is an ulterior motive.

* Second: secrets are stored in the cloud. Guess what the key to access them is? An SMS. Yes those un-encrypted, un-signed, un-authenticated, spoof-able, forward-able, plain-text, non-guaranteed delivery, MITM ready, message system. Seriously?

* Third: No choice for migrating to another app. Even though Authy has access to your secrets, you cannot export them. There is an ulterior motive here. Authy does not want you leaving them and will play dirty to keep your on their platform.

* Fourth: You will get locked out of everything if Authy decides to pull the plug on you. If you get 'cancelled' for having a non-popular opinion, Authy could revoke access to every single one of your accounts.

Avoid like dysentery.

Couldn't be happier with Raivo OTP on iPhone. Unfortunately it's iOS only but as far as I know it's 100% work of passion and bullshit free app maintained by a single user. Allows to export your entries in a very nice way... which is very securing regarding the kind of data entrusted. No risk of being locked out. Thanks @tijme!

Also. Whatever app you use, when you set up OTP don't forget to save screenshots of your original qr codes, in a veracrypt container ideally. Don't rely (only) on other people's work and will for such sensitive and personal data.

I've never done this, but it seems like an excellent idea. With the QR code, you could always reinstall to a different app.

Aren't the keys encrypted with a PIN of your own chosing which you set and verify in the app?

As a side note, it seems to me that what you call "ulterior motive" is essentially vendor lock-in and I don't think that qualifies as an "ulterior motive".

Yes, use aegis instead of authy or google authenticator. Open source and option to export your keys (both encrypted and unencrypted)

Would prefer a cross-platform option. That one appears to be Android only.

I imagine if the secrets are exported, you could import them to any app which would be excellent.

What's a 2FA tool that meets your requirements?

Ah how timely, Authy outage today.

Again: avoid like the plague.

This looks like spam to me. A lot of the links in the article point to pages on the same site, rather than the original sources. For example, the links for Firefox and Brave point to download pages on TechSpot.

Just looking down the list makes me tired. If I have to give my data to one and only one party in return of many valuable service, I chose it to be google. I know they are not the initial google anymore but I do not have time to redesign my life with many, but many-many privacy focused apps, just because. My privacy from one single company is not that important. Benefits I get in return, and combining them under one umbrella, which is google, is extremely valuable on the other hand.

Any good alternate to google Places API. I need a kind of places name autocomplete to make sure users are able to look up something by landmark/location names. Google places autocomplete is very pricy. Is there any open database for such use case. I can have own look up around this data.

YouTube is the service that's most difficult to replace. Nebula is a paid-for alternative that's good, but it doesn't have nearly the number of content creators.

My own personal alternatives, but real ones not just another company:

- search :: use one or another, simply because the SOLE in the list really free is YaCy (distributed search based on solr) and it's actually not much good due to the small indexing activity by participants nodes. Seeing thing like https://noscriptfingerprint.com I consider privacy as an impossible thing, my strategy is simply regular wipe of WebVM [1] profile and round robin/semi-random choice of different search engines;

- mail :: simply do NOT use a webmail. It's true that we do not have modern MUA for generic users, but we still have modern MUA, like notmuch or mu4e, with some frontends from mutt to astroid not only Emacs. Having a personal domain name (to not being tied to any specific vendor) and pay a standard mail service (not one who craft proprietary protocols "for privacy") with IMAPs and SMTPs and that's done, mail syncing if needed (OfflineIMAP/Mbsync) or mail grabbing to a personal desktop or server (to serve multiple personal desktops) like classic fetchmail+MailDrop and done, a FAR better and faster than GMail solution;

- modern WebVM :: Firefox is the sole left "a bit FLOSS";

- Google Authenticator :: no need for a TOTP on a personal local-first infra, if needed classic ssh + key based auth is far simpler and better;

- Drive :: being local my Drive alternative is typically called hard-disk (ssd, to be more precise) in various forms, from classic 2.5" with a caddy to portable ones M.2 or 2.5" sata with built-in usb adapter in the case, they are far faster than Drive, far more reliable and effective as part of a personal infra with relevant backups;

- Calendar :: org-agenda is FAR superior to a point I see no reasons to a UI like Calendar;

- Docs suite :: I have org-mode, notes accessed/managed via org-roam/org-attach and classic LaTeX with personal templates. Issues might pops up for collaboration with people who do not know them, but overall results are so superior that there is no reasons to use a classic modern office suite;

- Photos :: even Shotwell works well enough;

- YouTube :: podcasts fetched via rss and local storage with a local player works beautifully well;

- Google Translate :: one or another in privacy terms are the same, unfortunately a good local version can't exists since it's a giant ML system, or to be more precise it can exists as a distributed tool, but so far no one have developed something AFAIK;

- Analytics :: I fail to see purpose for personal websites, for commerce etc anything FLOSS on their own server it's ok;

- Maps :: hard to find a better option, OSM is better in very few places, but not in the rest 99% of my usage so...

- Play Store :: any distro / FLOSS OS repos are FAR superior simply because they are the same things, without the crappy commercial part;

- Chrome OS :: I see no point i reviving dumb terminals with modern WebVM: if someone live on webcrapps... Well, it's better change them;

- Android :: I see some reasons to use a smartphone but in too many case it's not that needed.

- Hangouts :: Jami works well enough, no server required, SIP/RTP are fully interoperable with classic PSTN...

- Domains :: there are countless actors who sell domains...

Long story short: please do not look for "alternatives" in the sense of "copies/variant of something" but alternative paradigms. They are neglect these days, but still exists and often they are FAR superior to commercially backed ones.

[1] also known as "browsers" for legacy reasons

Reply on news.ycombinator.com