Cybergibbons is a security researcher who reverse engineers consumer devices and analyzes weaknesses in products like What3Words and IoT gadgets.
HN links his What3Words analysis, which points to usability problems, confusable word combinations and unsuitability for safety-critical use. The author also joined a discussion.
Hi, I am the author of this article, it's interesting to see it being discussed here. A few points:
It's definitely possible to reverse engineer the word list and other aspects of the w3w system. However I also want to make my anysis code public and I don't want to deal with w3w's lawyers.
w3w make the basic claim that 1. similar addresses are far away from each other and 2. this makes mistakes obvious.
1 isn't true because they use a very naive randomization method. This was described before in an excellent blog post https://cybergibbons.com/security-2/what3words-the-algorithm/ I added some equations in my work. In the worst case you end up with a run of addresses like
twice.over.x
word.again.y
repeat.phrase.z
...
And maybe 10km away another run like
twice.over.a
word.again.b
repeat.phrase.c
...
Only one word is different, which obviously makes it much easier to confuse addresses.
The other point is that around 25% of addresses (probably more) could be confused with 4 or more others. In that case, the AutoSuggest feature may not suggest the address you meant, and if it doesn't, there's not much you can do, since this is the only form of error correction available in w3w.
w3w is quite popular here in the UK and I can see the appeal, it is more fun to shout out green.apple.regret than some alphanumeric string. But given the above problems (which i am sure w3w know about) that doesn't seem like a good enough reason to trust an app like this with matters of life and…
Wow, that's kind of shocking. I mean, I know pretty much nothing about security, and even I could tell that coding your own 'crypto' based on a formula cracked about 200 years ago is a bad idea. Let alone the whole 'no way to update the software except by manually upgrading it with an installer' thing.
But honestly, I'd say this the least of anyone's concerns with this company. The linked article also mentions some other security issues in their work when discussing a lack of security 'culture', and one of the most terrifying ones is this:
http://cybergibbons.com/security-2/terrible-website-security-on-www-apprentices4fs-com/
They don't seem to hash passwords, they send them across the internet in plain text, ban people with the equivalent of setting a cookie on the PC and then sell software as 'secure'. That's kind of terrifying.
Using 'Free' could also be a nod to the fact that there are a lot of very similar sounding words in the What3Words system [1].
The What3Words word list is 40,000 words long. It is important that words in this list cannot be confused, otherwise they may be communicated incorrectly. For example band/banned, bare/bear, beat/beet are easily confused.
A quick inspection of their word list finds the following words that sound very, very similar to one another:
equivalence equivalents
incidence incidents
incite insight
incompetence incompetents
independence independents
innocence innocents
instance instants
intense intents
lightening lightning
ordinance ordnance
[1] https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
It is for-profit, but they have yet to turn a profit. Their financial situation is a disaster. 10s of millions of £ burned, with very little income. Look for yourself: https://find-and-update.company-information.service.gov.uk/company/08430008/filing-history
£31m loss in FY22.
Cybergibbons has also done a very good critique on how unsafe it is. See here: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
They are also very litigious towards people that call them out.
"Cybergibbons" from PentestPartners has done a teardown of W3W in 2021 on twitter. It was very spicy and the takeaway was not that it is just ugly implementation as some here suggest, but flawed by design:
What3Words – The Algorithm https://cybergibbons.com/security-2/what3words-the-algorithm/
Why What3Words is not suitable for safety critical applications https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
w3w fails at this, because it uses words that sound similar (recede reseed, innocence innocents, and many others: https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for-safety-critical-applications/). Good luck playing spelling bee of "clairvoyants" in emergency.
Some words may also be difficult to pronounce/hear/spell by non-native speakers. Unlike regular sentences, there's no context to disambiguate.