URL Shorteners Criticized For Weakening User Security And Privacy

If you've ever tried to link someone to a Google Maps URL, you'll undoubtedly understand the benefit of URL shorteners. With them, we can take grossly long URLs and shorten them to a mere fraction of their original length, allowing your Facebook status update to retain a clean look and actually put a few words alongside a URL in a tweet. There's a reason services like Google Maps and Twitter offer their own URL shorteners... they're convenient and useful.

According to a new report released out of Cornell Tech, however, we should be showing some concern over the use of URL shorteners. There's a lot more to this than simply hiding malware behind a short URL, although that's a great point in itself. Most websites do not reveal the actual URL behind a shortened one when hovered over, and really, that should be standard at this point.

But what about an enterprising user who doesn't want to hide a malicious site behind a shortener? With the right tools, they could perform a brute-force scan on every short URL imaginable. Create a Bit.ly for a picture album that includes photos you'd never want people to see? You better hope the album itself is protected, else someone is bound to stumble on them at some point.

Much like how attackers can brute force a password by throwing hundreds or even thousands of password attempts against a hash for hours, they could use similar technology to find all the shortened URLs on a particular service. URL shorteners usually generate 6 - 8 random characters at the end of their URLs to make them "unique", but because so few characters are actually used, it makes the job of brute force attackers a whole lot easier.

And it's not nudies that you should be worried about people finding, but rather financial information or anything else personal. According to the research, of the 42 million short URLs scanned, just over 3,000 of them led to publicly-accessible OneDrive folders. The researchers warn that once people find such a folder, it could be easily exploited.

The lesson to be learned here is to not use a URL shortener for something private. In other words, before creating a short URL, ask yourself if there'd be any problem with someone totally unrelated to you accessing it. Similarly, if you are handed a URL and are not sure if it should be trusted, a quick Google search will help you find a tool that reveals the true URL before you visit it. Overall, these are two simple things to keep in mind to better protect yourself while surfing.