Fixing the bit.ly security trap

[Aristos Queue]

So, I've been bothered lately by bit.ly links. These are URLs to http://bit.ly/... that are ubiquitous across the web.

 

How many years have we preached to users, "Do NOT ever click on links that go to websites you do not trust? Avoid websites that redirect you to new servers?" Well, that's exactly what bit.ly does, and it relies upon the security blindness of most of the populace to be a viable system. The advantage of a bit.ly link is all in the market tracking -- it allows a website to hand out different bit.ly masks to different media outlets and then track which URL is the most used for getting back to the site.

 

But how do I know that this funky bit.ly URL, with its garbled characters, is actually going to the reputable URL that it claims to be going to? I can't. So, frustrated, I have avoided clicking on many links. But I've found a workaround. You can do this...

 

tl;dr:

Take the bit.ly URL and add a + to the end of it. This brings up the statistics page for that bit.ly link AND it displays the real URL that the link goes to. Then you can copy/paste that real link into your browser or, if you don't mind the tracking, you can go remove the + and let bit.ly do the redirect for you.

 

Annoying, but at least straightforward.

[Mike Le]

FireFox users may be interested in the Long URL Please add-on.

[Aristos Queue]

FireFox users may be interested in the Long URL Please add-on.

That worked well!

[hooovahh]

So, I've been bothered lately by bit.ly links. These are URLs to http://bit.ly/... that are ubiquitous across the web.

 

How many years have we preached to users, "Do NOT ever click on links that go to websites you do not trust? 

Oh live a little on the wild side once in a while.  Have you never visited a site with where the letter "s" is replaced with the letter "z" and you have more popups then Windows can handle.  When you've gone that far into the internet and survived without a virus, that is the day you have won.

[crelf]

...how do I know that this funky bit.ly URL, with its garbled characters, is actually going to the reputable URL that it claims to be going to?

 

You can't. Same way that you can't be sure that any url is actually going to the reputable URL that it claims to be going to. The main difference is that bit.ly doesn't even pretend to be taking you to a reputable URL. Why? Because bit.ly isn't about trying to represent anything that's trustworthy - it's about whether you trust the bit.ly's link *poster*.

 

 

tl;dr:

Take the bit.ly URL and add a + to the end of it. This brings up the statistics page for that bit.ly link AND it displays the real URL that the link goes to. Then you can copy/paste that real link into your browser or, if you don't mind the tracking, you can go remove the + and let bit.ly do the redirect for you.

Okay, that is kinda neat - thanks for sharing.

 

Note: the @lavag twitter account uses bit.ly exclusively as our link shortener. Why? Because we like to occasionally look at which of our posts interest our followers: bit.ly gives us stats on that, so we can better hone the types and frequency of tweets. So there.