Top all-time · #2933
Cybergibbons
Personal blog · cybergibbons.comsecurityhardware
Cybergibbons is a personal blog at cybergibbons.com about security and hardware. Since 2013, 26 different Hacker News readers have linked it 35 times, most often “Why What3Words is not suitable for safety critical applications”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers link this blog's critiques of What3Words, arguing its geocoding is unsafe for emergencies, that its word list has confusable words, and reporting on its reverse-engineered algorithm.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Reverse engineer, hardware hacker, security analyst, lock picker, heist planner. Definitely not involved in the Hatton Garden job.
Most-linked posts?
- Why What3Words is not suitable for safety critical applications16 people · 17 mentions · first linked 2021-04-29
- What3Words – The Algorithm3 people · 3 mentions · first linked 2021-05-02
- Another example of why you shouldn't roll-your-own crypto2 people · 2 mentions · first linked 2015-11-27
- Why is unauthenticated encryption insecure?2 people · 2 mentions · first linked 2020-09-20
What Hacker News says?
Plus, fraught with usability issues https://cybergibbons.com/security-2/why-what3words-is-not-su...
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “We need to liberate the Postcode Address File”Submitted What3Words – The Algorithm as a story · 305 points
HN discussionYeah, that's not true. https://cybergibbons.com/security-2/why-what3words-is-not-su...
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “What3Words sends legal threat to security researcher for sharing an alternative”Submitted A Warning to Users of NurseryCam as a story · 167 points
HN discussionUsing 'Free' could also be a nod to the fact that there are a lot of very similar sounding words in the What3Words system [1]. The What3Words word list is 40,000 words long. It is important that words in this list cannot be confused, otherwise they may be communicated incorrectly. For example band/banned, bare/bear, beat/beet are easily confused. A quick inspection of their word list finds the following words that s…
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “What3Words sends legal threat to security researcher for sharing an alternative”Submitted Why What3Words is not suitable for safety critical applications as a story · 63 points
HN discussionThe initial blog post with more of the technical detail is here: https://cybergibbons.com/security-2/serious-issues-in-nurser...
Comment linking /security-2/serious-issues-in-nurserycam/
on “A Warning to Users of NurseryCam”Submitted Why is unauthenticated encryption insecure? as a story · 63 points
HN discussionHere’s the result of @cybergibbons’ reverse engineering into the distribution over w3w terms that only differ in singular vs. plural: https://cybergibbons.com/security-2/why-what3words-is-not-su...
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “Rescuers question what3words' use in emergencies”Submitted What3Words – The Algorithm as a story · 24 points
HN discussionRelated: Cybergibbons: Why What3Words is not suitable for safety critical applications (2021)[1] HN discussion here[2]. [1] https://cybergibbons.com/security-2/why-what3words-is-not-su... [2] https://news.ycombinator.com/item?id=27058271
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “FixPhrase – open-source, patent-free what3words alternative”Submitted Eternal Vigilance Is the Price of Liberty as a story · 17 points
HN discussionw3w fails at this, because it uses words that sound similar (recede reseed, innocence innocents, and many others: https://cybergibbons.com/security-2/why-what3words-is-not-su... ). Good luck playing spelling bee of "clairvoyants" in emergency. Some words may also be difficult to pronounce/hear/spell by non-native speakers. Unlike regular sentences, there's no context to disambiguate.
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “FixPhrase – open-source, patent-free what3words alternative”Submitted Another example of why you shouldn't roll-your-own crypto as a story · 12 points
HN discussion...and how do you know which word you meant (even if it's not garbled)? The number of homonyms (and near-homonyms) in English in huge It's been a major issue for some users of W3W (eg https://cybergibbons.com/security-2/why-what3words-is-not-su... )
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “Ask HN: Why is there no high quality method for voice control of a PC?”Submitted Why What3Words is not suitable for safety critical applications as a story · 7 points
HN discussionWow, that's kind of shocking. I mean, I know pretty much nothing about security, and even I could tell that coding your own 'crypto' based on a formula cracked about 200 years ago is a bad idea. Let alone the whole 'no way to update the software except by manually upgrading it with an installer' thing. But honestly, I'd say this the least of anyone's concerns with this company. The linked article also mentions some…
Comment linking /security-2/terrible-website-security-on-www-apprentices4fs-com/
on “Another example of why you shouldn't roll-your-own crypto”Submitted CSL Dualcom CS2300-R signalling unit vulnerabilities as a story · 6 points
HN discussionRather than long/lat, I love the concept of using Zooko’s triangle for a geospatial problem, such as: - human meaningful - decentralized - secure However, w3w's isn't that. It is a centralized system which is actively enforced and it isn't secure. There is actually quite a lot of critics of w3w, such as: https://cybergibbons.com/security-2/why-what3words-is-not-su...
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “Unique 3-word identifiers for every 3 meter square on Earth”Submitted Heatmiser WiFi thermostat vulnerabilities as a story · 6 points
HN discussionHi, I am the author of this article, it's interesting to see it being discussed here. A few points: It's definitely possible to reverse engineer the word list and other aspects of the w3w system. However I also want to make my anysis code public and I don't want to deal with w3w's lawyers. w3w make the basic claim that 1. similar addresses are far away from each other and 2. this makes mistakes obvious. 1 isn't true…
Comment linking /security-2/what3words-the-algorithm/
on “A Critical Analysis of the What3Words Geocoding Algorithm”Submitted Why What3Words is not suitable for safety critical applications as a story · 3 points
HN discussion"Cybergibbons" from PentestPartners has done a teardown of W3W in 2021 on twitter. It was very spicy and the takeaway was not that it is just ugly implementation as some here suggest, but flawed by design: What3Words – The Algorithm https://cybergibbons.com/security-2/what3words-the-algorithm... Why What3Words is not suitable for safety critical applications https://cybergibbons.com/security-2/why-what3words-is-not-…
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “A Critical Analysis of the What3Words Geocoding Algorithm”Submitted Reverse engineering a wireless burglar alarm, part 1 as a story · 3 points
HN discussionIt is for-profit, but they have yet to turn a profit. Their financial situation is a disaster. 10s of millions of £ burned, with very little income. Look for yourself: https://find-and-update.company-information.service.gov.uk/c... £31m loss in FY22. Cybergibbons has also done a very good critique on how unsafe it is. See here: https://cybergibbons.com/security-2/why-what3words-is-not-su... They are also very litigi…
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “A Critical Analysis of the What3Words Geocoding Algorithm”Submitted Why is unauthenticated encryption insecure? as a story · 2 points
HN discussionIt looks like a security researcher has looked into it and was sued (!) for releasing his source code. https://cybergibbons.com/security-2/why-what3words-is-not-su... https://techcrunch.com/2021/04/30/what3words-legal-threat-wh...
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “A Critical Analysis of the What3Words Geocoding Algorithm”Submitted Why What3Words is not suitable for safety critical applications as a story · 2 points
HN discussionNo, and by my understanding it can't be, as the algorithm is now permanent. But it's worse than that, there are confusables within small distances of each other: https://cybergibbons.com/security-2/why-what3words-is-not-su... https://w3w.me.ss/
Comment linking /security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
on “Deep dive into the UK air traffic control meltdown”Submitted BC Vault – is their security model better? as a story · 2 points
HN discussion
