8 ms·

By obscuring the real destination, it's also terrible for security.

peterhunt 8y ago
That’s completely the opposite of reality. The whole point of link shortening on a social network is to improve security and reduce abuse.
- Alex3917 8y ago
  > The whole point of link shortening on a social network is to improve security and reduce abuse. How does link shortening do that?
  - peterhunt 8y ago
    See this great post by Matt Jones (from FB antispam/security team) about Facebook's link shortener https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://www.facebook.com/notes/facebook-security/link-shim-p...
    - Alex3917 8y ago
      That's a decent point about email, but there is nothing they're doing on the website that couldn't be done without a link shortener. And even within the context of email it doesn't really make sense, because email clients can just do the same thing without rewriting the URL.
      - peterhunt 8y ago
        How would you show an interstitial without rewriting the url?
        megous 8y ago
        onclick handler and event.preventDefault
        makomk 8y ago
        Replacing links with onclick handlers breaks "open in new tab".
        megous 8y ago
        You can use window.open to simulate that. If you're fb, you're probably already whitelisted in the popup blocker. Though I agree it's not ideal.
        Alex3917 8y ago
        Every time a link is clicked, send an event to the server with the URL so that it can be tracked. If the URL is already known to be malicious when the page is generated, either don't include the URL or use javascript to intercept the click event and display the interstitial. If links need to be checked for validity at the moment the user clicks them, then just wait for the 200 response and do the same thing, the performance would be identical either way.
        peterhunt 8y ago
        And you think running that type of JS on the page is more secure than a simple redirect? What benefit do we get by adding all of this complexity? Also -- anyone who views a copy/pasted version of this content won't get this protection.
        Alex3917 8y ago
        > And you think running that type of JS on the page is more secure than a simple redirect? It's not more secure, but it's not less secure and it doesn't break the web. It also shouldn't add an appreciable amount of complexity, given that most of the heavy lifting to sanitize, parse, and format UGC content already happens on the server. E.g. if you're already turning UGC snippets into an AST on the server so that you can cleanly syndicate them in different formats, having the AST generate some js around URLs isn't a big lift.
    - inetknght 8y ago
      I'd like to read this but I have facebook blackholed and refuse to change that. Do you have another link?
      - ambicapter 8y ago
        https://web.archive.org/web/20180818114317/https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://web.archive.org/web/20180818114317/https://www.faceb...
      - TeMPOraL 8y ago
        TL;DR: clicking on their shortener can trigger just-in-time malware scan; they can retroactively block links already sent to people; they can strip away the Referer; they can inject their own analytics.
- freehunter 8y ago
  How so? By shortening the link, you're hiding where the link goes to. bit.ly/12345 could go to amazon.com or big-scam-with-a-virus.com, and until you click on it you'd never know.
  - TheSmiddy 8y ago
    Once the link shortening service knows it's a scam they can redirect you to a "saved you from being scammed" page. (although evidence of this happening in practice hasn't crossed my radar, but it's probably because I just don't click those links in the first place)
    - deleted 8y ago
      [deleted]
    - eridius 8y ago
      You don't need a link shortening service for that. The website and API can just start changing the URL it includes in the tweet if it determines the original URL is a scam.
    - megous 8y ago
      They can redirect you anywhere. They can also rewrite anything in the URL, like add affiliate IDs or whatever. I'm sure some of them do that, because why not.
  - shpx 8y ago
    With bit.ly specifically, add a "+" at the end of the url to see what it points to. It also shows you some stats like creation date and number of clicks over time. https://bit.ly/19y8wyr+ https://bit.ly/19y8wyr+
    - Ayesh 8y ago
      TIL. Thank you.
    - esnard 8y ago
      It also works for goo.gl links. [0] Also note that a ".info" suffix might sometimes be easier to type. [1][2] Too bad most URL shorteners don't support them. :( [0]: http://goo.gl/vulnz+ http://goo.gl/vulnz+ [1]: https://bitly.com/19y8wyr.info https://bitly.com/19y8wyr.info [2]: http://goo.gl/vulnz.info http://goo.gl/vulnz.info
- jest3r1 8y ago
  Link shortening makes it easier to brute force. Shortened links become trackable by a third-party (less secure), obfuscate the real URL (less secure), and can be brute forced easier: https://www.schneier.com/blog/archives/2016/04/security_risks_11.html https://www.schneier.com/blog/archives/2016/04/security_risk...
- unstuckdev 8y ago
  The point of link shortening was to allow links within the constraint of 140 characters.
- userbinator 8y ago
  That sounds like the same authoritarian justification for hiding URLs in browsers and such --- "we'll tell you if it's safe, you don't need to know"...
  - peterhunt 8y ago
    It's not like you can't see the original URL and manually skip the redirect if you wanted to. It's just that most users won't do that which limits the ROI of spam and phishing campaigns.
clubm8 8y ago
> By obscuring the real destination, it's also terrible for security. Ah yes, I remember when Tinyurl first came into play - people were extremely hesitant to click anything behind one because so often it was a goatse.
- nvr219 8y ago
  that's why they added preview.tinyurl.com feature

That’s completely the opposite of reality. The whole point of link shortening on a social network is to improve security and reduce abuse.

Alex3917 8y ago
> The whole point of link shortening on a social network is to improve security and reduce abuse. How does link shortening do that?
- peterhunt 8y ago
  See this great post by Matt Jones (from FB antispam/security team) about Facebook's link shortener https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://www.facebook.com/notes/facebook-security/link-shim-p...
  - Alex3917 8y ago
    That's a decent point about email, but there is nothing they're doing on the website that couldn't be done without a link shortener. And even within the context of email it doesn't really make sense, because email clients can just do the same thing without rewriting the URL.
    - peterhunt 8y ago
      How would you show an interstitial without rewriting the url?
      - megous 8y ago
        onclick handler and event.preventDefault
        makomk 8y ago
        Replacing links with onclick handlers breaks "open in new tab".
        megous 8y ago
        You can use window.open to simulate that. If you're fb, you're probably already whitelisted in the popup blocker. Though I agree it's not ideal.
      - Alex3917 8y ago
        Every time a link is clicked, send an event to the server with the URL so that it can be tracked. If the URL is already known to be malicious when the page is generated, either don't include the URL or use javascript to intercept the click event and display the interstitial. If links need to be checked for validity at the moment the user clicks them, then just wait for the 200 response and do the same thing, the performance would be identical either way.
        peterhunt 8y ago
        And you think running that type of JS on the page is more secure than a simple redirect? What benefit do we get by adding all of this complexity? Also -- anyone who views a copy/pasted version of this content won't get this protection.
        Alex3917 8y ago
        > And you think running that type of JS on the page is more secure than a simple redirect? It's not more secure, but it's not less secure and it doesn't break the web. It also shouldn't add an appreciable amount of complexity, given that most of the heavy lifting to sanitize, parse, and format UGC content already happens on the server. E.g. if you're already turning UGC snippets into an AST on the server so that you can cleanly syndicate them in different formats, having the AST generate some js around URLs isn't a big lift.
  - inetknght 8y ago
    I'd like to read this but I have facebook blackholed and refuse to change that. Do you have another link?
    - ambicapter 8y ago
      https://web.archive.org/web/20180818114317/https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://web.archive.org/web/20180818114317/https://www.faceb...
    - TeMPOraL 8y ago
      TL;DR: clicking on their shortener can trigger just-in-time malware scan; they can retroactively block links already sent to people; they can strip away the Referer; they can inject their own analytics.
freehunter 8y ago
How so? By shortening the link, you're hiding where the link goes to. bit.ly/12345 could go to amazon.com or big-scam-with-a-virus.com, and until you click on it you'd never know.
- TheSmiddy 8y ago
  Once the link shortening service knows it's a scam they can redirect you to a "saved you from being scammed" page. (although evidence of this happening in practice hasn't crossed my radar, but it's probably because I just don't click those links in the first place)
  - deleted 8y ago
    [deleted]
  - eridius 8y ago
    You don't need a link shortening service for that. The website and API can just start changing the URL it includes in the tweet if it determines the original URL is a scam.
  - megous 8y ago
    They can redirect you anywhere. They can also rewrite anything in the URL, like add affiliate IDs or whatever. I'm sure some of them do that, because why not.
- shpx 8y ago
  With bit.ly specifically, add a "+" at the end of the url to see what it points to. It also shows you some stats like creation date and number of clicks over time. https://bit.ly/19y8wyr+ https://bit.ly/19y8wyr+
  - Ayesh 8y ago
    TIL. Thank you.
  - esnard 8y ago
    It also works for goo.gl links. [0] Also note that a ".info" suffix might sometimes be easier to type. [1][2] Too bad most URL shorteners don't support them. :( [0]: http://goo.gl/vulnz+ http://goo.gl/vulnz+ [1]: https://bitly.com/19y8wyr.info https://bitly.com/19y8wyr.info [2]: http://goo.gl/vulnz.info http://goo.gl/vulnz.info
jest3r1 8y ago
Link shortening makes it easier to brute force. Shortened links become trackable by a third-party (less secure), obfuscate the real URL (less secure), and can be brute forced easier: https://www.schneier.com/blog/archives/2016/04/security_risks_11.html https://www.schneier.com/blog/archives/2016/04/security_risk...
unstuckdev 8y ago
The point of link shortening was to allow links within the constraint of 140 characters.
userbinator 8y ago
That sounds like the same authoritarian justification for hiding URLs in browsers and such --- "we'll tell you if it's safe, you don't need to know"...
- peterhunt 8y ago
  It's not like you can't see the original URL and manually skip the redirect if you wanted to. It's just that most users won't do that which limits the ROI of spam and phishing campaigns.

clubm8 8y ago

> By obscuring the real destination, it's also terrible for security. Ah yes, I remember when Tinyurl first came into play - people were extremely hesitant to click anything behind one because so often it was a goatse.

nvr219 8y ago
that's why they added preview.tinyurl.com feature