URL shortening services like Bitly and TinyURL have become quite popular in recent years. They provide a way to create shortened aliases for long URLs, making them easier to share on social media and messaging platforms with character limits. However, shortened URLs also come with some security risks that users should be aware of.
How URL Shortening Services Work
URL shortening services use a redirect to send users from a short URL to the original long URL target. Here’s a quick overview of how they work:
- A user enters a long URL into the URL shortener
- The shortening service generates a random unique short alias
- The service stores the mapping between the short URL and the original URL on their servers
- When a user clicks the short URL, the service redirects them to the destination URL
This allows links to be easily shared even when there are tight character limits, like in Tweets or text messages. The shortened link hides the potentially lengthy original URL.
Security Risks Introduced by Shortened URLs
While handy, shortened URLs do introduce some security and privacy issues that users should keep in mind:
Obfuscation of the Original URL
Shortened URLs make it impossible to identify the original URL without actually visiting it. This obfuscates the destination you’ll end up at. Malicious users can take advantage of this to send innocent-looking shortened links that redirect to phishing or malware sites. Most people don’t think twice before clicking shortened links.
Tracking and Profiling
URL shortening services track each link click to provide analytics to the person who created it. This allows the shortened link creator to profile visitors by keeping track of how many times the link was clicked, where clicks came from, user agents, IPs addresses and so on.
Link Rot
If a shortening service shuts down, all of their URLs may stop working and redirect to an unavailable page. This causes link rot and breaks any shortened URLs that were being used and shared around the web.
Spam and Malware
Because shortened URLs hide the original destination, they are often used for spam and malware campaigns. Cybercriminals send shortened links rather than longer malicious URLs to avoid detection. When users click them, they unknowingly get redirected to unsafe sites without realizing what the original URL was.
Best Practices around Shortened URLs
Keep these tips in mind to avoid issues from shortened URL links:
- Exercise caution before clicking them: You don’t know where they lead, so don’t blindly click them in emails or messages. Hover over them to preview the actual URLs.
- Use URL expanding services: Sites like Unshorten.it let you enter shortened URLs to view the original destination before visiting them. This gives you more information on where they lead.
- Don’t create short URLs to sensitive sites: Avoid creating shortened links to your online banking site or other sensitive logins. These could fall into the wrong hands.
Use only popular, established shorteners: Stick to services like Bitly or TinyURL that have been around for a while. Some malicious shorteners exist solely to create redirects for scams.
Other Potential Vulnerabilities in URL Shorteners
In addition to the issues called out above, there are some other common vulnerabilities found in URL shorteners that cybercriminals could exploit:
- Broken authentication & password flaws – improperly stored credentials could let attackers gain access to accounts.
- SQL injection – if user input is not sanitized correctly, attackers might be able to modify backend SQL queries to access databases.
- Cross-site scripting (XSS) – could let attackers inject malicious JavaScript payloads into links that get executed on click.
- Server-side request forgery (SSRF) – forces services to make arbitrary requests to internal networks & APIs not exposed publicly.
Developers creating shorteners need to take care to program their services defensively against these and other common web vulnerabilities. Failure to do so results in openings for attackers to exploit their infrastructure and put users at risk.
Proper testing for security flaws is crucial before launching URL shorteners and fixes have to be released swiftly when issues are uncovered.
For users, this means being cautious about which services you trust and recognizing that risks are inherent in URL-shortening utilities.
Should You Avoid Using URL Shorteners Entirely?
Shortened URLs definitely come with tradeoffs in terms of security, privacy, and link rot. However, avoiding them altogether may not be practical given how popular they’ve become. When used wisely, their convenience often outweighs potential downsides for most threat models.
Here are a few cases where URL shortening services still make sense to use:
- You need to share links where character counts are very limited, like text messages or tweets.
- You run marketing campaigns with lots of lengthy links that are visually cluttered.
- You want to be able to track the high-level click analytics on your links.
- You need to shorten just a few links once in a while when sharing them online.
Just be very judicious about what sites you create short links for – sensitive financial or login pages certainly don’t need additional risks introduced.
For sharing lots of links publicly, it’s wise to have a custom domain that points to your shortener of choice. That way you can easily transition if need be due to security issues or that service shutting down.
How to Choose a More Secure URL Shortener
If you do decide to use a URL shortening service, make sure to choose your provider wisely using this criteria:
- Offers site-wide HTTPS encryption
- Has a strong security vulnerability disclosure & bug bounty program
- Undergoes periodic third-party security audits
- Has been operating successfully for many years already
- Gives you the option to use custom domains for short links
- Provides visibility into analytics like IP addresses and user agents
Avoid any new or unproven shorteners that seem sketchy or don’t meet these security standards.
Sites like Bitly, Ow.ly, and Rebrandly ranked well in a recent secure URL shortener analysis for example. Just be sure to do your own research before picking a provider.
Wrapping Up
URL shortening services provide a lot of convenience but also introduce risks around phishing, tracking, and link rot. As a user, exercise caution when clicking shortened links and consider expanding them first to verify destinations.
For increased safety, use well-established shorteners that prioritize security in their offerings and leverage custom domains under your control. Avoid creating short links to sensitive sites and recognize that risks are inherent with these utilities.
Used judiciously, shortened URLs still serve a purpose in simplifying unwieldy long links. Just be an informed user, stick to reputable services, and think twice before clicking!
