Cybergibbons

Rather than long/lat, I love the concept of using Zooko’s triangle for a geospatial problem, such as: - human meaningful - decentralized - secure However, w3w's isn't that. It is a centralized system which is actively enforced and it isn't secure. There is actually quite a lot of critics of w3w, such as: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

Using 'Free' could also be a nod to the fact that there are a lot of very similar sounding words in the What3Words system [1]. The What3Words word list is 40,000 words long. It is important that words in this list cannot be confused, otherwise they may be communicated incorrectly. For example band/banned, bare/bear, beat/beet are easily confused. A quick inspection of their word list finds the following words that sound very, very similar to one another: equivalence equivalents incidence incidents incite insight incompetence incompetents independence independents innocence innocents instance instants intense intents lightening lightning ordinance ordnance [1] https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

Hi, I am the author of this article, it's interesting to see it being discussed here. A few points: It's definitely possible to reverse engineer the word list and other aspects of the w3w system. However I also want to make my anysis code public and I don't want to deal with w3w's lawyers. w3w make the basic claim that 1. similar addresses are far away from each other and 2. this makes mistakes obvious. 1 isn't true because they use a very naive randomization method. This was described before in an excellent blog post https://cybergibbons.com/security-2/what3words-the-algorithm/ I added some equations in my work. In the worst case you end up with a run of addresses like twice.over.x word.again.y repeat.phrase.z ... And maybe 10km away another run like twice.over.a word.again.b repeat.phrase.c ... Only one word is different, which obviously makes it much easier to confuse addresses. The other point is that around 25% of addresses (probably more) could be confused with 4 or more others. In that case, the AutoSuggest feature may not suggest the address you meant, and if it doesn't, there's not much you can do, since this is the only form of error correction available in w3w. w3w is quite popular here in the UK and I can see the appeal, it is more fun to shout out green.apple.regret than some alphanumeric string. But given the above problems (which i am sure w3w know about) that doesn't seem like a good enough reason to trust an app like this with matters of life and…

Plus, fraught with usability issues https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

No, and by my understanding it can't be, as the algorithm is now permanent. But it's worse than that, there are confusables within small distances of each other: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for… https://w3w.me.ss/

W3W contains homonyms and words that are easily confused by non-native english speakers. Often within just a few KM. The latter is why ATC uses "niner", to avoid confusing "nine" and "nein". Talk to someone deep in the GIS rabbit hole and you'll get a rant about how bad W3W is: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

"Cybergibbons" from PentestPartners has done a teardown of W3W in 2021 on twitter. It was very spicy and the takeaway was not that it is just ugly implementation as some here suggest, but flawed by design: What3Words – The Algorithm https://cybergibbons.com/security-2/what3words-the-algorithm/ Why What3Words is not suitable for safety critical applications https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

It looks like a security researcher has looked into it and was sued (!) for releasing his source code. https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for… https://techcrunch.com/2021/04/30/what3words-legal-threat-whatfreeword…

It is for-profit, but they have yet to turn a profit. Their financial situation is a disaster. 10s of millions of £ burned, with very little income. Look for yourself: https://find-and-update.company-information.service.gov.uk/company/084… £31m loss in FY22. Cybergibbons has also done a very good critique on how unsafe it is. See here: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for… They are also very litigious towards people that call them out.

Related: Cybergibbons: Why What3Words is not suitable for safety critical applications (2021)[1] HN discussion here[2]. [1] https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for… [2] https://news.ycombinator.com/item?id=27058271

w3w fails at this, because it uses words that sound similar (recede reseed, innocence innocents, and many others: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for… Good luck playing spelling bee of "clairvoyants" in emergency. Some words may also be difficult to pronounce/hear/spell by non-native speakers. Unlike regular sentences, there's no context to disambiguate.

...and how do you know which word you meant (even if it's not garbled)? The number of homonyms (and near-homonyms) in English in huge It's been a major issue for some users of W3W (eg https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

Here’s the result of @cybergibbons’ reverse engineering into the distribution over w3w terms that only differ in singular vs. plural: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

Yeah, that's not true. https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for…

The initial blog post with more of the technical detail is here: https://cybergibbons.com/security-2/serious-issues-in-nurserycam/

Wow, that's kind of shocking. I mean, I know pretty much nothing about security, and even I could tell that coding your own 'crypto' based on a formula cracked about 200 years ago is a bad idea. Let alone the whole 'no way to update the software except by manually upgrading it with an installer' thing. But honestly, I'd say this the least of anyone's concerns with this company. The linked article also mentions some other security issues in their work when discussing a lack of security 'culture', and one of the most terrifying ones is this: http://cybergibbons.com/security-2/terrible-website-security-on-www-ap… They don't seem to hash passwords, they send them across the internet in plain text, ban people with the equivalent of setting a cookie on the PC and then sell software as 'secure'. That's kind of terrifying.