Why What3Words is not suitable for safety critical applications(cybergibbons.com)
cybergibbons.com
Why What3Words is not suitable for safety critical applications
https://cybergibbons.com/security-2/why-what3words-is-not-suitable-for-safety-critical-applications/
35 comments
Related discussion from a few days ago: https://news.ycombinator.com/item?id=27015046
See also: https://news.ycombinator.com/item?id=27020810
See also: https://news.ycombinator.com/item?id=27020810
What's so interesting: Outside of HN a lot of people I speak to are super-pumped about W3W.
On HN the general sentiment is quite negative.
I can't reconcile it yet.
On HN the general sentiment is quite negative.
I can't reconcile it yet.
I think the idea is pretty good but the execution is terrible.
We had a tyre blow out on a motorway in Scotland and I had to try to describe to the breakdown company where we were. I knew the name of the motorway by looking at Google maps but the area around us was utterly featureless and there were no nearby landmarks I could use to describe our location more accurately.
I had the W3W app so tried to tell them the location using that but unfortunately the wind and traffic noise made it nearly impossible for them to understand the words clearly enough and then I realised they didn't have the app at their end anyway.
The best way to sort out the problems with W3W is for a better system to replace it. That system needs to be open and widely adopted - it's crazy I can't send my location easily to someone without asking what apps that have on their phone.
We had a tyre blow out on a motorway in Scotland and I had to try to describe to the breakdown company where we were. I knew the name of the motorway by looking at Google maps but the area around us was utterly featureless and there were no nearby landmarks I could use to describe our location more accurately.
I had the W3W app so tried to tell them the location using that but unfortunately the wind and traffic noise made it nearly impossible for them to understand the words clearly enough and then I realised they didn't have the app at their end anyway.
The best way to sort out the problems with W3W is for a better system to replace it. That system needs to be open and widely adopted - it's crazy I can't send my location easily to someone without asking what apps that have on their phone.
Perhaps I’m missing something, but don’t longitude and latitude already solve this problem? They are extremely accurate, and don’t require a specific app.
Do you have decimal degrees or degrees minutes second? Did you remember the "-" sign? Is Lat and Lon in the right order?
Thus, geocoding, like MGRS or Plus Code.
Thus, geocoding, like MGRS or Plus Code.
Long/lay are indeed accurate, but are cumbersome to communicate verbally. In the parent comment you are responding to, loud wind and other background noise would make accurately transmitting a long string of numbers equally if not more difficult.
Unlike lat/long, which requires precise addressing, words can have an inherent error-correction mechanism built into them, wherein the listener may not hear the entire word, but can piece it together. This admittedly is of less use for W3W where the word sets are random and not related to each other. That said, if you were in receipt of a garbled w3w code, you could theoretically narrow down your search parameters using the parts of it you heard.
That’s maybe giving w3w more benefit of the doubt than deserved, though.
Unlike lat/long, which requires precise addressing, words can have an inherent error-correction mechanism built into them, wherein the listener may not hear the entire word, but can piece it together. This admittedly is of less use for W3W where the word sets are random and not related to each other. That said, if you were in receipt of a garbled w3w code, you could theoretically narrow down your search parameters using the parts of it you heard.
That’s maybe giving w3w more benefit of the doubt than deserved, though.
Numbers are also spoken using words, and the words for digits 1-9 have fairly distinct sounds with the possible exception of five and nine. W3w's advantage is more in the small number of words required.
I can't think of many use cases where w3w would be more convenient than an app/protocol for simply transmitting your GPS location to another person. Maybe if you had a GPS connection and mobile signal but no internet connection.
I can't think of many use cases where w3w would be more convenient than an app/protocol for simply transmitting your GPS location to another person. Maybe if you had a GPS connection and mobile signal but no internet connection.
> W3w's advantage is more in the small number of words required
Digits have ten words. If five and nine are confusing, imagine trying to guess if the person meant flower, flour or floor, and guessing according to their accent.
If one to ten is confusing, you can always find 10 or 100 very distinct words to replace digits or pairs of them. You could also press numbers on your phone's keypad, or even send them as morse or binary.
Digits have ten words. If five and nine are confusing, imagine trying to guess if the person meant flower, flour or floor, and guessing according to their accent.
If one to ten is confusing, you can always find 10 or 100 very distinct words to replace digits or pairs of them. You could also press numbers on your phone's keypad, or even send them as morse or binary.
> imagine trying to guess if the person meant flower, flour or floor
I'd hope that w3w's word list is built to avoid this potential confusion, but I could be wrong.
> you can always find 10 or 100 very distinct words to replace digits or pairs of them
True, although if you wanted to spread news by word of mouth of a secret gathering in the woods, then having just three words for the location is easy to remember and transmit.
Beyond those very niche edge cases, I don't really see much point.
I'd hope that w3w's word list is built to avoid this potential confusion, but I could be wrong.
> you can always find 10 or 100 very distinct words to replace digits or pairs of them
True, although if you wanted to spread news by word of mouth of a secret gathering in the woods, then having just three words for the location is easy to remember and transmit.
Beyond those very niche edge cases, I don't really see much point.
The article you are replying to is invalidating those points.
Well lat long is the standard for marine operations and a mayday call uses it. In order to get a marine radio licence you have to demonstrate that you can correctly transmit a mayday. It works OK in noisy conditions because we say it in a standard format that everyone is expecting. E.g “My position is North five four decimal six three one East zero zero six decimal five two niner” this should probably be taught in school, my kids were taught basic CPR in primary school here so I don’t see why this couldn’t be taught this too.
Plus Codes works well, and Google Maps tells you the plus code for any location.
> We had a tyre blow out on a motorway in Scotland
All UK motorways have location signs posted every 500m (coupled with distance marker posts at 100m intervals) that are specifically designed so drivers with breakdowns can report their position...... not to mention the (free) orange SOS landline phones every 1 mile which, if used, will automatically report your position. (a little arrow on the marker post points to the nearest SOS phone; you are never more than half a mile from one).
You had to learn this for your driving test :-)
https://en.wikipedia.org/wiki/Driver_location_sign
EDIT: My mistake, only England has adopted the driver location signs. The rest of the UK makes do with the distance marker post system (and SOS phones if needed).
All UK motorways have location signs posted every 500m (coupled with distance marker posts at 100m intervals) that are specifically designed so drivers with breakdowns can report their position...... not to mention the (free) orange SOS landline phones every 1 mile which, if used, will automatically report your position. (a little arrow on the marker post points to the nearest SOS phone; you are never more than half a mile from one).
You had to learn this for your driving test :-)
https://en.wikipedia.org/wiki/Driver_location_sign
EDIT: My mistake, only England has adopted the driver location signs. The rest of the UK makes do with the distance marker post system (and SOS phones if needed).
>You had to learn this for your driving test :-)
I passed my test a decade before they were introduced.
I passed my test a decade before they were introduced.
> Outside of HN a lot of people I meet and speak to are super-pumped about W3W.
Lots of people have heard positive media fluff that W3W have paid to have placed, and haven't really thought critically about it at all.
Lots of people have heard positive media fluff that W3W have paid to have placed, and haven't really thought critically about it at all.
W3W is an amazingly cool idea... on the surface. Once you scratch that surface, it has lots of issues, ranging from inconveniences to critical. The HN crowd is likelier to dig into a cool idea like this and surface a few problems. All it takes is adding hype to a couple of semi-serious issues to rub a certain type of hacker the wrong way, which leads to more digging, which leads to more problems being found, and it spirals from there.
Not everyone out there even truly understands what it does and when it works well. Yet many people are just really gullible to marketing when it happens to push right buttons like "safety", "help to emergency services" etc.
I had a chat once with older non-tech folks from cycling group I ride with. They were indeed "super-pumped" to use w3w to share location when someone got lost on a ride. The sharing would happen through our common whatsapp group, not voice, but they simply would not listen to my point that "live location" feature was there for ages, and is far superior in this particular scenario.
I had a chat once with older non-tech folks from cycling group I ride with. They were indeed "super-pumped" to use w3w to share location when someone got lost on a ride. The sharing would happen through our common whatsapp group, not voice, but they simply would not listen to my point that "live location" feature was there for ages, and is far superior in this particular scenario.
Plus Codes are a better choice.
https://github.com/google/open-location-code/wiki/Evaluation...
https://github.com/google/open-location-code/wiki/Evaluation...
I like Placekey’s implementation. Hexagons provide an equidistant center.
Over the phone, even “F” and “S” are confusable. The what3words list is too long and has too many uncommon words to be reliably used on phone-calls. And in that case, what's even the point?
For those not familiar with the backstory, here is a quick summary (quoted from @AaronToponce https://twitter.com/aarontoponce/status/1389163266417430533?...):
1. In 2018, What Free Words (WFW) reverse engineers what3words (w3w) in a clean room with JavaScript.
2. WFW is ported to other languages.
3. In 2019, w3w legally goes after WFW for trademark and copyright infringement.
4. WFW is effectively pulled offline.
5. In 2021, @cybergibbons begins his research into w3w testing their claims.
6. I offer to help, still having a copy of the WFW JavaScript source code.
7. I offer to privately distribute that source code to other researchers.
8. Two people reach out to me asking for a copy.
9. April 29, 2021, I receive a cease and desist email from the w3w legal firm threatening I have 7 days to comply.
10. Being ignorant to legal cyber bullying, I comply with their demands.
11. I share my experience on Twitter.
12. The tweet goes viral.
13. The original WFW JavaScript source code is found elsewhere online, and shared and copied in multiple Twitter threads.
14. Other languages are uncovered also.
15. Prior art is uncovered to potentially invalidate w3w patents.
16. @zackwhittaker interviews me for TechCrunch
17. The TechCrunch article goes online.
18. It's shared on other social media platforms.
19. May 2, 2021, I receive an email from the w3w legal firm that w3w considers the matter resolved.
20. @cybergibbons publishes his findings uncovering severe problems with w3w algorithm
P.S.
My intent of being willing to share the WFW source code was not to compete with w3w, nor cause them any harm. The intent was to help @cybergibbons look into their claims of safety and security, to ultimately improve the service. However, I know intent is not a defense.
1. In 2018, What Free Words (WFW) reverse engineers what3words (w3w) in a clean room with JavaScript.
2. WFW is ported to other languages.
3. In 2019, w3w legally goes after WFW for trademark and copyright infringement.
4. WFW is effectively pulled offline.
5. In 2021, @cybergibbons begins his research into w3w testing their claims.
6. I offer to help, still having a copy of the WFW JavaScript source code.
7. I offer to privately distribute that source code to other researchers.
8. Two people reach out to me asking for a copy.
9. April 29, 2021, I receive a cease and desist email from the w3w legal firm threatening I have 7 days to comply.
10. Being ignorant to legal cyber bullying, I comply with their demands.
11. I share my experience on Twitter.
12. The tweet goes viral.
13. The original WFW JavaScript source code is found elsewhere online, and shared and copied in multiple Twitter threads.
14. Other languages are uncovered also.
15. Prior art is uncovered to potentially invalidate w3w patents.
16. @zackwhittaker interviews me for TechCrunch
17. The TechCrunch article goes online.
18. It's shared on other social media platforms.
19. May 2, 2021, I receive an email from the w3w legal firm that w3w considers the matter resolved.
20. @cybergibbons publishes his findings uncovering severe problems with w3w algorithm
P.S.
My intent of being willing to share the WFW source code was not to compete with w3w, nor cause them any harm. The intent was to help @cybergibbons look into their claims of safety and security, to ultimately improve the service. However, I know intent is not a defense.
Knowing the history of W3W I'm not particularly keen on them, but I don't think this is actually an incredibly strong criticism of the system. Yes, it's possible to make mistakes with this system, and there are probabilities of the mistaken words putting you in the wrong place - but the odds are fairly low, and it misses one key point: W3W helps you communicate a direction, it doesn't need to be the only method of communicating the location. Taking the River Clyde example - what's the likelihood of you being in either of those locations, and telling people the W3W phrase alone? There's no way you're going to do that. The first thing you're going to say is "I'm on the north bank of the Clyde" or "I'm standing right next to the M8 motorway".
The basic way of safely communicating information is very simple - communicate more information so that the receiver can use the consistency of the extra information to check what they're receiving is right. If you're phoning the police and give them W3W, they might mishear - but what's the likelihood they mishear in a way that is consistent with their knowledge about which cell tower your mobile phone is pinging off.
The basic way of safely communicating information is very simple - communicate more information so that the receiver can use the consistency of the extra information to check what they're receiving is right. If you're phoning the police and give them W3W, they might mishear - but what's the likelihood they mishear in a way that is consistent with their knowledge about which cell tower your mobile phone is pinging off.
The problem is, people are using solely what3words for location. Every single call recording to emergency services doesn't use any other information.
The odds are around 1 in 24 that you hit one of these squares in London.
The odds are around 1 in 24 that you hit one of these squares in London.
I might have missed existing discussion, but what is wrong with GPS coordinates? If digits are good enough for NATO fire missions, they're probably good enough for lost hikers.
- They're ubiquitous and do not require a shared codebook. I can find my GPS coordinates on a paper map.
- They are easy to transmit clearly regardless of medium, language or accent. Digits are the first words you'll learn in any language. Pronunciation can't be taken for granted [1].
- They offer unlimited precision, but 10-12 digits are enough to pinpoint your exact location [2]
- They let you see where you stand relative to another person on the same grid. It's a bit like trying to find your friend in Manhattan.
- They let you picture where someone roughly is without even looking at the map. You can perform error correction as the digits are being read to you. If someone is off-grid, you can tell immediately. This scene [3] comes to mind - the officer is calling a fire mission in the wrong country, and everyone can immediately tell.
Take Berlin - 52.5200 N, 13.4050 E: "Five Two Point Five Two North - One Three Point Four Zero Five Zero East".
[1] https://www.youtube.com/watch?v=yR0lWICH3rY [2] https://xkcd.com/2170/ [3] https://youtu.be/K9uXLzZyucI?t=87
- They're ubiquitous and do not require a shared codebook. I can find my GPS coordinates on a paper map.
- They are easy to transmit clearly regardless of medium, language or accent. Digits are the first words you'll learn in any language. Pronunciation can't be taken for granted [1].
- They offer unlimited precision, but 10-12 digits are enough to pinpoint your exact location [2]
- They let you see where you stand relative to another person on the same grid. It's a bit like trying to find your friend in Manhattan.
- They let you picture where someone roughly is without even looking at the map. You can perform error correction as the digits are being read to you. If someone is off-grid, you can tell immediately. This scene [3] comes to mind - the officer is calling a fire mission in the wrong country, and everyone can immediately tell.
Take Berlin - 52.5200 N, 13.4050 E: "Five Two Point Five Two North - One Three Point Four Zero Five Zero East".
[1] https://www.youtube.com/watch?v=yR0lWICH3rY [2] https://xkcd.com/2170/ [3] https://youtu.be/K9uXLzZyucI?t=87
Ambiguity: Did I forget the N/S? Is it supposed to be +/-? Did I get Lat and Lon flipped? Is it decimal degrees or degrees minutes seconds?
The decimal degrees vs DMS is the big one, by the way. Especially since it's not always obvious that it's one or the other.
This is actually why the US military invented MGRS, which is a grid square reference (giving precision to 100km), then northing and easting coordinates (every pair of digits improves accuracy by 10x). And you may already be able to assume the map square, and give just the northing and easting numbers.
Plus code is related, but instead of using northing and easting, it uses a 4x5 grid with alphanumeric ids, that then subdivide after getting your grid square, allowing change in precision just by truncation, instead of having to truncate the northing and easting values seperately. It's also slightly more compact, as the greater number base available compared to decimal allows less digits to be used, and therefore faster to write and communicate, especially over the phone.
The decimal degrees vs DMS is the big one, by the way. Especially since it's not always obvious that it's one or the other.
This is actually why the US military invented MGRS, which is a grid square reference (giving precision to 100km), then northing and easting coordinates (every pair of digits improves accuracy by 10x). And you may already be able to assume the map square, and give just the northing and easting numbers.
Plus code is related, but instead of using northing and easting, it uses a 4x5 grid with alphanumeric ids, that then subdivide after getting your grid square, allowing change in precision just by truncation, instead of having to truncate the northing and easting values seperately. It's also slightly more compact, as the greater number base available compared to decimal allows less digits to be used, and therefore faster to write and communicate, especially over the phone.
There are always exceptions, but one slight annoyance in the UK is that you can have the same coordinate but omitting the + or - at the start will change where it is (which if you are in line with Greenwich, for instance, can even be in the same town).
This is effectively the same problem as stated in the blog post where similar numbers can lead to different places. Interestingly this can be seen in your example too.
> - 52.5200 N, 13.4050 E
If I read the "-" as a negative, this is in the middle of the ocean. If I read it as a delimiter from the sentence before, I get Germany. Not so much of a problem as you said Germany as a context clue, but if this was in the UK I would have two possible interpretations.
For instance - 0.5 N, 300 E might be more of a challenge!
This is effectively the same problem as stated in the blog post where similar numbers can lead to different places. Interestingly this can be seen in your example too.
> - 52.5200 N, 13.4050 E
If I read the "-" as a negative, this is in the middle of the ocean. If I read it as a delimiter from the sentence before, I get Germany. Not so much of a problem as you said Germany as a context clue, but if this was in the UK I would have two possible interpretations.
For instance - 0.5 N, 300 E might be more of a challenge!
This can be fixed without inventing a new system. Someone else in the thread gave an example of a mayday call that eliminates those issues.
In any case, it's easier to figure out if the person meant east or west (or check both) than to figure out if they meant flour, flower, floor, lower or some other similar word. It becomes even sillier when you account for accents. I'm not sure how to pronounce certain English words, including flour.
> If I read the "-" as a negative
That shouldn't be a problem, since you'd hear the words over the phone, not in a HN comment.
In any case, it's easier to figure out if the person meant east or west (or check both) than to figure out if they meant flour, flower, floor, lower or some other similar word. It becomes even sillier when you account for accents. I'm not sure how to pronounce certain English words, including flour.
> If I read the "-" as a negative
That shouldn't be a problem, since you'd hear the words over the phone, not in a HN comment.
> That shouldn't be a problem, since you'd hear the words over the phone, not in a HN comment.
I know, I just found it a little ironic that those coordinates could be misinterpreted considering the article was about misinterpreting words being a fundamental weakness of w3w :)
I know, I just found it a little ironic that those coordinates could be misinterpreted considering the article was about misinterpreting words being a fundamental weakness of w3w :)
If the goal is clarity on the internet, a Google Maps link ought to do it.
The only issue i have is:
Is it "lon, lat" or "lat, lon".
(If "N/S E/W is not specified and only + or - provided)
(If "N/S E/W is not specified and only + or - provided)
That was a very interesting read! I've had W3W on my phone for a while now but never really needed to use it. On occasions I'd try finding my W3W in different parts of the house but didn't get reproducible results. Today was an eye-opener though as I used the W3W site to locate my position: all good.
Then I mis-typed my words and got a message "Invalid what3words address URL", but instead of not displaying anything it decided to re-locate me some 200+ miles away in The Strand, London, with 3 completely different words! WTF?! I have no idea how this happened, but if I was in an unsafe state and quoted these incorrect words, I'd be in big trouble!
Then I mis-typed my words and got a message "Invalid what3words address URL", but instead of not displaying anything it decided to re-locate me some 200+ miles away in The Strand, London, with 3 completely different words! WTF?! I have no idea how this happened, but if I was in an unsafe state and quoted these incorrect words, I'd be in big trouble!
I believe the intent of having the slightly wrong words give a large difference in location was to make it obvious that a slightly wrong location string is wrong. If you know you're somewhere in Virginia, and it says England, they dispatcher can ask for it again.
The intent maybe was there, but there are too many similar sounding or looking words that are much closer nearby where you can't be sure whether it's correct or not. There are also some news reports of rescue services ending up miles away from the caller because of a bad w3w code.
I would hope so :) But the fact that it "located" me somewhere else with 3 completely different words doesn't fill me with confidence!
Total.Charlie.Foxtrot.
Like, who is the anticipated audience or userbase? Hopefully not children. Harried adults I'd rather see just use GPS coordinates. If you've got a phone capable of doing these lookups, then you've got both GPS and inertial navigation capability. Things like N/S are going to be implied based on where you're actually calling. If you're crank calling other jurisdictions, please don't. Furthermore, once you've got the operator homing in on grid, then they can provide further detail about your location (sometimes) for further verification.
God look after the dyslexics though.